Azure部署C# Web API调用接口出现SSL证书链UntrustedRoot错误

我正在使用C#基于Azure App Services开发Web API，尝试向另一Web API提交请求，请求代码如下：

_objClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("basic", credential);
var multipartFormContent = new MultipartFormDataContent();
multipartFormContent.Add(new StringContent(product.Name), name: "name");
multipartFormContent.Add(new StringContent(product.Price), name: "price");
MemoryStream ms = new(product.catalogue);
var fileStreamContent = new StreamContent(ms);
fileStreamContent.Headers.ContentType = new MediaTypeHeaderValue("application/octet-stream");
multipartFormContent.Add(fileStreamContent, name: "content", fileName: product.Name);
var response = _objClient.PostAsync(_settings.UploadProductCatalogueUrl, multipartFormContent).GetAwaiter().GetResult();

调用PostAsync时返回错误：

异常信息：
The SSL connection could not be established, see inner exception.
内部异常：
The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot.
堆栈跟踪：
at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request)
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at Microsoft.Extensions.Http.Logging.LoggingHttpMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
at Microsoft.Extensions.Http.Logging.LoggingScopeHttpMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at ProductCatalogue.UploadProductCatalogue(CatalogueDto catalogue)

代码在本地运行正常，但部署到Azure后出现此错误，寻求解决办法。

• 确认目标API证书合法性
  目标API的SSL证书必须由公共信任的CA颁发。如果是自签名证书或内部私有CA颁发的证书，Azure App Service默认不会信任这类证书，这是本地正常、Azure报错的核心原因。

• 导入根证书到Azure App Service
  如果目标API使用私有CA/自签证书，需将对应的根证书（.cer格式）上传到App Service：

  1. 登录Azure门户，进入你的App Service资源
  2. 找到TLS/SSL设置 → 证书（.cer），上传根证书
  3. 复制证书的指纹，在配置 → 应用程序设置中添加WEBSITE_LOAD_ROOT_CERTIFICATES，值为证书指纹（多个证书用逗号分隔）
  4. 重启App Service，此时应用会信任该根证书

• 修复HttpClient异步调用问题
  代码中使用GetAwaiter().GetResult()会阻塞线程，容易引发死锁，生产环境必须改成异步调用：

  // 方法声明改为async Task
  public async Task UploadProductCatalogueAsync(CatalogueDto catalogue)
  {
      // ... 其他代码不变
      var response = await _objClient.PostAsync(_settings.UploadProductCatalogueUrl, multipartFormContent);
      response.EnsureSuccessStatusCode(); // 可添加状态码验证
  }
  

• 临时绕过证书验证（仅测试环境）
  仅限测试场景使用，生产环境绝对禁止，会带来安全风险：

  var handler = new HttpClientHandler();
  handler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true;
  var _objClient = new HttpClient(handler);
  

• 检查网络环境配置
  如果目标API部署在Azure虚拟网络内，确保你的App Service已加入同一VNet，或通过私有端点访问目标API。这种场景下，内部CA颁发的证书在VNet内通常能被信任。

内容的提问来源于stack exchange，提问作者Gideon