EF Core7在Docker容器中出现RemoteCertificateValidationCallback错误

问题概述 #

本地运行正常的.NET 7 + EF Core 7项目，部署到Docker容器后无法连接SQL Server，抛出证书验证相关的预登录握手错误。

连接字符串 #

server=xxx.xxx.xxx.xxx,1432;database=DbName;user id=sa;password=DbPassword123;TrustServerCertificate=True;

错误日志 #

Microsoft.Data.SqlClient.SqlException (0x80131904): A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 35 - An internal exception was caught)

System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback.

相关配置文件 #

Dockerfile #

FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443

FROM mcr.microsoft.com/dotnet/sdk:7.0 AS build
WORKDIR /src
COPY ["Project.Api/Project.Api.csproj", "Project.Api/"]
COPY ["Project.Module.Admin/Project.Module.Admin.csproj", "Project.Module.Admin/"]
COPY ["Project.Module.Shared/Project.Module.Shared.csproj", "Project.Module.Shared/"]
COPY ["Project.Data/Project.Data.csproj", "Project.Data/"]
COPY ["Project.Infrastructure/Project.Infrastructure.csproj", "Project.Infrastructure/"]
COPY ["Project.Identity/Project.Identity.csproj", "Project.Identity/"]
COPY ["Project.Job/Project.Job.csproj", "Project.Job/"]
COPY ["Project.Module.Driver/Project.Module.Driver.csproj", "Project.Module.Driver/"]
COPY ["Project.Module.User/Project.Module.User.csproj", "Project.Module.User/"]
RUN dotnet restore "Project.Api/Project.Api.csproj"
COPY . .
WORKDIR "/src/Project.Api"
RUN dotnet build "Project.Api.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "Project.Api.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "Project.Api.dll"]

docker-compose.yml #

version: "3.4"
services:
  db-production:
    image: "mcr.microsoft.com/mssql/server:2022-latest"
    container_name: db-production
    restart: always
    environment:
      ACCEPT_EULA: "Y"
      MSSQL_SA_PASSWORD: "DbPassword123"
    volumes:
      - /home/volumes/mssql/data/production:/var/opt/mssql/data
    ports:
      - "1432:1433"
  backend-production:
    image: "backend_production:${TAG}"
    container_name: backend-production
    environment:
      - "ASPNETCORE_ENVIRONMENT=Production"
    build:
      context: .
      dockerfile: Project.Api/Dockerfile
    ports:
      - "${EXPOSED_PORT_PRODUCTION}:80"
    restart: unless-stopped
    depends_on:
      - db-production

解决方案 #

• 修正容器内的SQL Server连接地址：Docker Compose中同服务组的容器可通过服务名直接通信，无需宿主机IP。将连接字符串中的server=xxx.xxx.xxx.xxx,1432替换为server=db-production,1433（SQL Server容器内部端口为1433，容器间通信使用内部端口）。

• 确认TrustServerCertificate=True配置生效：若连接字符串设置后仍无效，可在EF Core的DbContext配置中显式声明：

  protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
  {
      optionsBuilder.UseSqlServer(@"server=db-production,1433;database=DbName;user id=sa;password=DbPassword123;TrustServerCertificate=True;");
  }
  

• 临时禁用SQL Server强制加密（仅测试环境）：在db-production服务的environment中添加MSSQL_TLS_ENABLED: "0"，关闭证书验证要求。注意生产环境需配置合法SSL证书，不建议使用此方法。

• 检查容器网络连通性：进入backend-production容器，执行ping db-production和telnet db-production 1433验证网络是否通畅。默认情况下同一Compose文件的服务会加入同一网络，若不通需检查网络配置。

内容的提问来源于stack exchange，提问作者Sajjad Saharkhan