.NET HttpClientHandler自定义证书验证时如何扩展AuthenticationException信息

问题背景 #

我基于示例实现了自定义ServerCertificateCustomValidationCallback，该回调会检查chain.Build结果、检测SslPolicyErrors值以及验证失败时的ChainElementStatus，但验证失败时仅能返回bool值。当自定义回调返回false时，HttpClient抛出的AuthenticationException仅包含通用提示："The remote certificate was rejected by the provided RemoteCertificateValidationCallback."；而未定义自定义回调时，微软默认实现抛出的异常会包含具体错误信息，如："The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot"。

解决方案 #

由于自定义回调只能返回bool值，无法直接在回调中抛出带详情的异常，我们可以通过提前保存验证失败的详情信息，在捕获请求异常后重新包装抛出的方式实现需求，具体步骤如下：

1. 定义错误信息存储类
   创建一个类来保存验证失败时的SslPolicyErrors和ChainElementStatus信息：

public class CertificateValidationFailureDetails
{
    public SslPolicyErrors PolicyErrors { get; set; }
    public X509ChainStatus[] ChainStatus { get; set; }
}

2. 在回调中记录错误信息
   初始化HttpClientHandler时，实例化错误存储类，并在自定义验证逻辑失败时填充错误信息：

var failureDetails = new CertificateValidationFailureDetails();

var handler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) =>
    {
        bool isValid = true;

        // 执行自定义验证逻辑
        if (!chain.Build(cert))
        {
            isValid = false;
            failureDetails.PolicyErrors = sslPolicyErrors;
            failureDetails.ChainStatus = chain.ChainStatus;
        }
        // 可添加其他验证规则，比如检查证书有效期、颁发者等
        // ...

        return isValid;
    }
};

var httpClient = new HttpClient(handler);

3. 捕获异常并重新包装抛出
   发送请求时捕获AuthenticationException，结合保存的错误信息生成带详情的异常重新抛出：

try
{
    var response = await httpClient.GetAsync("https://your-target-domain.com");
    response.EnsureSuccessStatusCode();
}
catch (AuthenticationException ex)
{
    if (failureDetails.PolicyErrors != SslPolicyErrors.None || failureDetails.ChainStatus?.Any() == true)
    {
        var chainErrorMsg = string.Join("; ", failureDetails.ChainStatus.Select(s => $"{s.StatusInformation} ({s.Status})"));
        var detailedMsg = $"远程证书验证失败：SslPolicyErrors={failureDetails.PolicyErrors}，证书链错误：{chainErrorMsg}";
        throw new AuthenticationException(detailedMsg, ex);
    }
    // 无自定义错误信息时，抛出原异常
    throw;
}

补充说明 #

如果希望更贴近微软默认的异常格式，可调整错误信息的拼接逻辑，比如模仿默认提示的写法：

var detailedMsg = $"The remote certificate is invalid because of errors in the certificate chain: {string.Join(", ", failureDetails.ChainStatus.Select(s => s.Status.ToString()))}";

内容的提问来源于stack exchange，提问作者RickyTad