.NET 5.0/6.0下HttpClient本地SSL证书连接异常求助

本地使用HttpClient访问IIS Express托管的HTTPS地址时，浏览器可正常访问，但代码在.NET Core 2.1中运行正常，.NET 5.0和6.0中抛出SSL连接异常。已执行dotnet dev-certs https --trust命令，证书由Visual Studio 2022的IIS Express对话框生成。

相关代码 #

var httpClient = new HttpClient();
var url = Url.ActionLink("");
using var response = await httpClient.GetAsync(url);
var content = await response.Content.ReadAsStringAsync();

报错信息 #

An unhandled exception occurred while processing the request.
SocketException: An existing connection was forcibly closed by the remote host. Unknown location

IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host..
System.Net.Sockets.Socket+AwaitableSocketAsyncEventArgs.ThrowException(SocketError error, CancellationToken cancellationToken)

HttpRequestException: The SSL connection could not be established, see inner exception.
System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, bool async, Stream stream, CancellationToken cancellationToken)

1. 验证IIS Express证书与dotnet dev-certs的一致性 #

• 打开IIS Express配置文件：%USERPROFILE%\Documents\IISExpress\config\applicationhost.config
• 找到对应站点的<bindings>节点，查看certificateHash值（例如：<binding protocol="https" bindingInformation="*:44300:localhost" sslFlags="0" certificateHash="ABC123..." />）
• 运行命令dotnet dev-certs https --check --verbose，查看输出中"Trusted HTTPS certificate"的哈希值
• 若两者不一致，执行以下步骤：
  1. dotnet dev-certs https --clean 清理旧证书
  2. dotnet dev-certs https --trust 重新生成并信任证书
  3. 重启Visual Studio和IIS Express

2. 临时调试：配置HttpClient跳过SSL验证（仅限本地开发） #

.NET 5+对SSL验证的默认规则更严格，可临时配置HttpClient跳过证书验证（生产环境禁止使用）：

var handler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
};
var httpClient = new HttpClient(handler);

var url = Url.ActionLink("");
using var response = await httpClient.GetAsync(url);
var content = await response.Content.ReadAsStringAsync();

3. 强制使用兼容的TLS版本 #

.NET 5+默认启用TLS 1.3，部分旧版IIS Express可能仅支持TLS 1.2，可强制HttpClient使用TLS 1.2：

var handler = new HttpClientHandler
{
    SslProtocols = SslProtocols.Tls12
};
var httpClient = new HttpClient(handler);

var url = Url.ActionLink("");
using var response = await httpClient.GetAsync(url);
var content = await response.Content.ReadAsStringAsync();

4. 重置开发环境 #

• 关闭Visual Studio和IIS Express（右键任务栏IIS Express图标选择"Exit"）
• 清理项目的bin和obj文件夹，重新编译运行
• 检查Windows证书管理器中是否存在过期或冲突的localhost证书（路径：控制面板 → 管理工具 → 证书 → 当前用户 → 个人 → 证书），删除无关的localhost证书

内容的提问来源于stack exchange，提问作者Mb Mb