.NET4.6下如何为X509Certificate2设置私钥与主机名？

1. 合并证书与私钥（关键步骤） #

你当前加载的.crt文件仅包含公钥，mTLS认证需要带私钥的完整证书。由于你的私钥是PKCS#8格式（以-----BEGIN PRIVATE KEY-----开头），有两种处理方式：

代码内直接合并（.NET 5+） #

使用X509Certificate2.CreateFromPem方法直接合并证书和私钥内容：

string certText = File.ReadAllText(@"D:\somefile.crt");
string keyText = File.ReadAllText(@"D:\privatekey.key");

// 创建带私钥的完整证书
var certWithKey = X509Certificate2.CreateFromPem(certText, keyText);

提前转成PFX文件（生产环境推荐） #

用OpenSSL命令将crt和key打包成PFX格式（密码可留空）：

openssl pkcs12 -export -out cert.pfx -inkey privatekey.key -in somefile.crt

代码中直接加载PFX文件：

var certWithKey = new X509Certificate2(@"D:\cert.pfx");

2. 指定主机名的两种场景 #

场景1：设置请求Host头 #

如果API要求请求头中指定Host，直接在HttpClient中配置：

var handler = new HttpClientHandler();
handler.ClientCertificates.Add(certWithKey);

using var client = new HttpClient(handler);
string targetHost = "your-api-host.com";
client.DefaultRequestHeaders.Host = targetHost;

// 发送请求
var response = await client.GetAsync($"https://{targetHost}/api/your-endpoint");

场景2：配置SNI（Server Name Indication） #

若API服务器使用多域名证书，需要指定SNI的目标主机，使用SocketsHttpHandler更灵活（.NET 5+）：

var handler = new SocketsHttpHandler
{
    SslOptions = new SslClientAuthenticationOptions
    {
        ClientCertificates = new X509CertificateCollection { certWithKey },
        TargetHost = "your-api-host.com" // 指定SNI主机名
    }
};

using var client = new HttpClient(handler);
var response = await client.GetAsync("https://your-api-host.com/api/your-endpoint");

完整示例代码（.NET 5+） #

string certPath = @"D:\somefile.crt";
string keyPath = @"D:\privatekey.key";
string apiHost = "your-api-host.com";

// 合并证书与私钥
var clientCert = X509Certificate2.CreateFromPem(File.ReadAllText(certPath), File.ReadAllText(keyPath));

// 配置HttpClient
var handler = new SocketsHttpHandler
{
    SslOptions = new SslClientAuthenticationOptions
    {
        ClientCertificates = new X509CertificateCollection { clientCert },
        TargetHost = apiHost
    }
};

using var client = new HttpClient(handler);
client.DefaultRequestHeaders.Host = apiHost;

// 发送请求并处理响应
var response = await client.GetAsync($"https://{apiHost}/api/your-endpoint");
response.EnsureSuccessStatusCode();
var responseContent = await response.Content.ReadAsStringAsync();

内容的提问来源于stack exchange，提问作者ricarterick