Fedora 36下.NET Core 3.1连接MySQL遇OpenSslCryptographicException问题

问题背景 #

使用.NET Core 3.1控制台应用连接MySQL，依赖DBUP库。因新版Ubuntu不再支持.NET Core 3.1，切换至仍支持该版本的Fedora 36后，出现加密相关异常：
Interop+Crypto+OpenSslCryptographicException: error:0E076071:configuration file routines:module_run:unknown module name

推测是Fedora 36缺少对应加密套件或OpenSSL版本兼容性问题，完整异常栈如下：

System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception.
 ---> System.TypeInitializationException: The type initializer for 'SslMethods' threw an exception.
 ---> System.TypeInitializationException: The type initializer for 'Ssl' threw an exception.
 ---> System.TypeInitializationException: The type initializer for 'SslInitializer' threw an exception.
 ---> Interop+Crypto+OpenSslCryptographicException: error:0E076071:configuration file routines:module_run:unknown module name
   at Interop.SslInitializer..cctor() in /_/src/Common/src/Interop/Unix/System.Net.Security.Native/Interop.Initialization.cs:line 33
   --- End of inner exception stack trace ---
   at Interop.Ssl..cctor() in /_/src/Common/src/Interop/Unix/System.Net.Security.Native/Interop.Initialization.cs:line 16
   --- End of inner exception stack trace ---
   at Interop.Ssl.SslV2_3Method()
   at Interop.Ssl.SslMethods..cctor() in /_/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Ssl.cs:line 194
   --- End of inner exception stack trace ---
   at Interop.OpenSsl.AllocateSslContext(SslProtocols protocols, SafeX509Handle certHandle, SafeEvpPKeyHandle certKeyHandle, EncryptionPolicy policy, SslAuthenticationOptions sslAuthenticationOptions) in /_/src/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs:line 60
   at System.Net.Security.SafeDeleteSslContext..ctor(SafeFreeSslCredentials credential, SslAuthenticationOptions sslAuthenticationOptions) in /_/src/Common/src/System/Net/Security/Unix/SafeDeleteSslContext.cs:line 30
   at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential, SafeDeleteContext& context, ArraySegment`1 inputBuffer, Byte[]& outputBuffer, SslAuthenticationOptions sslAuthenticationOptions) in /_/src/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs:line 111
   --- End of inner exception stack trace ---
   at System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs:line 713
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs:line 557
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs:line 528
   at System.Net.Security.SslStream.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs:line 398
   at System.Net.Security.SslStream.ProcessAuthentication(LazyAsyncResult lazyResult, CancellationToken cancellationToken) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.Implementation.cs:line 312
   at System.Net.Security.SslStream.BeginAuthenticateAsClient(SslClientAuthenticationOptions sslClientAuthenticationOptions, CancellationToken cancellationToken, AsyncCallback asyncCallback, Object asyncState) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.cs:line 234
   at System.Net.Security.SslStream.BeginAuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation, AsyncCallback asyncCallback, Object asyncState) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.cs:line 222
   at System.Net.Security.SslStream.<>c.<AuthenticateAsClientAsync>b__64_1(String arg1, X509CertificateCollection arg2, SslProtocols arg3, AsyncCallback callback, Object state) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.cs:line 392
   at System.Threading.Tasks.TaskFactory`1.FromAsyncImpl[TArg1,TArg2,TArg3](Func`6 beginMethod, Func`2 endFunction, Action`1 endAction, TArg1 arg1, TArg2 arg2, TArg3 arg3, Object state, TaskCreationOptions creationOptions) in /_/src/System.Private.CoreLib/shared/System/Threading/Tasks/FutureFactory.cs:line 1152
   at System.Threading.Tasks.TaskFactory.FromAsync[TArg1,TArg2,TArg3](Func`6 beginMethod, Action`1 endMethod, TArg1 arg1, TArg2 arg2, TArg3 arg3, Object state, TaskCreationOptions creationOptions) in /_/src/System.Private.CoreLib/shared/System/Threading/Tasks/TaskFactory.cs:line 1135
   at System.Threading.Tasks.TaskFactory.FromAsync[TArg1,TArg2,TArg3](Func`6 beginMethod, Action`1 endMethod, TArg1 arg1, TArg2 arg2, TArg3 arg3, Object state) in /_/src/System.Private.CoreLib/shared/System/Threading/Tasks/TaskFactory.cs:line 1092
   at System.Net.Security.SslStream.AuthenticateAsClientAsync(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation) in /_/src/System.Net.Security/src/System/Net/Security/SslStream.cs:line 393
   at MySql.Data.Common.Ssl.StartSSL(Stream& baseStream, Encoding encoding, String connectionString)
   at MySql.Data.MySqlClient.NativeDriver.Open()
   at MySql.Data.MySqlClient.Driver.Open()
   at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)
   at MySql.Data.MySqlClient.MySqlPool.CreateNewPooledConnection()
   at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()
   at MySql.Data.MySqlClient.MySqlPool.TryToGetDriver()
   at MySql.Data.MySqlClient.MySqlPool.GetConnection()
   at MySql.Data.MySqlClient.MySqlConnection.Open()
   at MySqlExtensions.MySqlDatabase(SupportedDatabasesForEnsureDatabase supported, String connectionString, IUpgradeLog logger, Int32 timeout, String collation)
   at MySqlExtensions.MySqlDatabase(SupportedDatabasesForEnsureDatabase supported, String connectionString)
   at db_up_migration.Program.Main(String[] args) in /home/dbup/Program.cs:line 36

解决方案 #

1. 安装完整的OpenSSL依赖 #

执行以下命令安装Fedora 36上的OpenSSL相关组件：

sudo dnf install openssl openssl-libs openssl-devel

2. 强制使用OpenSSL 1.1版本 #

.NET Core 3.1对OpenSSL 3.x兼容性有限，设置环境变量强制使用1.1版本：

export CLR_OPENSSL_VERSION_OVERRIDE=1.1

若需要永久生效，可将该命令添加到~/.bashrc或/etc/profile文件中。

3. 调整MySQL连接字符串 #

在连接字符串中明确指定SSL模式和兼容的TLS协议，例如：

server=your-mysql-host;user=username;password=password;database=dbname;SslMode=Required;SslProtocol=TLS1.2

4. 更新MySQL驱动 #

确保使用适配.NET Core 3.1的最新MySQL驱动版本，修复已知的兼容性问题。

内容的提问来源于stack exchange，提问作者Dallas Morrison