.NET Core WebAPI部署Linux Docker后无法读取证书问题

我开发了一个使用证书调用外部服务的.NET Core WebAPI，在Windows环境运行正常，但部署到Linux Docker镜像中时无法找到证书。

Docker构建脚本 #

FROM mcr.microsoft.com/dotnet/aspnet:5.0
WORKDIR /app
EXPOSE 80

# Copy csproj and restore as distinct layers
COPY "bin/Release/net5.0/linux-x64" ./

# set noninteractive installation
ENV DEBIAN_FRONTEND=noninteractive

COPY MyCertificate.crt /usr/local/share/ca-certificates/MyCertificate.crt
RUN update-ca-certificates

ENTRYPOINT ["dotnet", "MyApp.dll"]

构建输出（证书已成功添加） #

Step 10/12 : COPY MyCertificate.crt /usr/local/share/ca-certificates/MyCertificate.crt
 ---> bfea272fa88d
Step 11/12 : RUN update-ca-certificates
 ---> Running in 4c3844714aea
Updating certificates in /etc/ssl/certs...
1 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

查找证书的代码（无法找到目标证书） #

X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);

store.Open(OpenFlags.ReadOnly);

var certs = new StringBuilder();
foreach (X509Certificate2 certificate in store.Certificates)
{
    certs.Append(certificate.Thumbprint);
}

问题原因 #

你将证书添加到了系统信任根证书目录（/usr/local/share/ca-certificates/），但代码中是从当前用户的个人证书存储（StoreName.My, StoreLocation.CurrentUser）查找证书。两者属于不同的证书存储位置：

• Linux下，.NET的CurrentUser\My对应路径为~/.dotnet/corefx/cryptography/x509stores/my/，和系统根证书目录/etc/ssl/certs完全无关。

解决方案 #

方案1：修改代码从系统根存储查找证书

将证书存储改为系统根存储，对应代码修改如下：

X509Store store = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);

var certs = new StringBuilder();
foreach (X509Certificate2 certificate in store.Certificates)
{
    certs.Append(certificate.Thumbprint);
}

方案2：将证书导入到CurrentUser的My存储

修改Dockerfile，将证书复制到.NET对应存储目录：

# 创建.NET个人证书存储目录
RUN mkdir -p /root/.dotnet/corefx/cryptography/x509stores/my/

# 复制证书到该目录
COPY MyCertificate.crt /root/.dotnet/corefx/cryptography/x509stores/my/

注意：部分场景下可能需要将证书转换为.pem格式，可通过openssl x509 -in MyCertificate.crt -out MyCertificate.pem -outform PEM命令转换后再复制。

方案3：直接从文件加载证书（推荐）

跳过证书存储，直接读取证书文件，避免环境差异：

// 读取证书文件
var certPath = Path.Combine(AppContext.BaseDirectory, "MyCertificate.crt");
var certificate = new X509Certificate2(certPath);

// 使用证书调用外部服务

同时修改Dockerfile，将证书复制到应用目录：

COPY MyCertificate.crt ./MyCertificate.crt

内容的提问来源于stack exchange，提问作者Irvin Dominin