IIS安全调整后C# .NET API返回200但无响应体问题求助

• 环境：部署在Windows Server 2012 R2的IIS 8.5上的C# .NET API
• 近期安全调整：
  1. 禁用部分SSL/TLS版本
  2. 安装新的自签名SSL证书
  3. 禁用部分密码套件
• 异常现象：
  该API在线上服务器返回200 OK状态，但无响应体；本地运行完全正常。其他API无论线上还是本地用Postman测试均正常。

相关代码 #

using Microsoft.Owin;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Jwt;
using Microsoft.Owin.Security.OAuth;
using Owin;
using System;
using System.IO;
using System.Security.Cryptography.X509Certificates;
using System.Web.Http;
using Raqeeb.Common;
using System.Configuration;
using Microsoft.Owin.Security.Cookies;

namespace test.Apis
{
    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            app.Use<GlobalExceptionMiddleware>();
            HttpConfiguration config = new HttpConfiguration();
            WebApiConfig.Register(config);

            ConfigureWebOAuth(app);
            app.UseWebApi(config);
        }

        public void ConfigureWebOAuth(IAppBuilder app)
        {
            OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
            {
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString("/api/authorization/login"),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                Provider = new AuthorizationWebServerProvider(),
                AccessTokenFormat = new CustomJwtFormat(ConfigurationManager.AppSettings["OAuthAccessTokenIssuer"].ToString()),
                AuthenticationMode = AuthenticationMode.Active,
            };

            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                CookieHttpOnly = true,
                CookiePath="/path",
                CookieSecure = CookieSecureOption.Always,
            });

            app.UseOAuthAuthorizationServer(OAuthServerOptions);
            X509Certificate2 cert = new X509Certificate2(Path.Combine(Utility.AssemblyDirectory, ConfigurationManager.AppSettings["PublicCertificate"]), ConfigurationManager.AppSettings["CertificatePassword"]);
            app.UseJwtBearerAuthentication(
                new JwtBearerAuthenticationOptions
                {
                    AuthenticationMode = AuthenticationMode.Active,
                    AllowedAudiences = new[] { "http://localhost" },
                    IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                    {
                        new X509CertificateSecurityTokenProvider("http://localhost", cert)
                    },
                });
       }

        public void ConfigureAppOAuth(IAppBuilder app)
        {
            OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
            {
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString("/api/authorization/get-access"),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                Provider = new AuthorizationAppServerProvider(),
                AccessTokenFormat = new CustomJwtFormat(ConfigurationManager.AppSettings["OAuthAccessTokenIssuer"].ToString())
            };

            app.UseOAuthAuthorizationServer(OAuthServerOptions);
            X509Certificate2 cert = new X509Certificate2(Path.Combine(Utility.AssemblyDirectory, ConfigurationManager.AppSettings["PublicCertificate"]), ConfigurationManager.AppSettings["CertificatePassword"]);
           app.UseJwtBearerAuthentication(
                new JwtBearerAuthenticationOptions
                {
                    AuthenticationMode = AuthenticationMode.Active,
                    AllowedAudiences = new[] { "http://localhost" },
                    IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                    {
                        new X509CertificateSecurityTokenProvider("http://localhost", cert)
                    },
                });
        }
    }
}

可能的解决方案 #

1. 调整CookieSecure配置 #

你在CookieAuthenticationOptions中设置了CookieSecure = CookieSecureOption.Always，该配置强制Cookie仅通过HTTPS传输。如果线上环境SSL调整后存在握手异常（如TLS版本不兼容、证书信任问题），会导致Cookie无法正常传递，中断认证流程，最终返回空响应体。

可以临时修改为CookieSecure = CookieSecureOption.SameAsRequest测试：

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    CookieHttpOnly = true,
    CookiePath="/path",
    CookieSecure = CookieSecureOption.SameAsRequest,
});

2. 给自签名证书私钥添加权限 #

新安装的自签名证书可能未给IIS应用程序池账户（例如IIS AppPool\你的应用池名称）授予私钥读取权限，操作步骤：

• 打开certlm.msc（本地计算机证书管理器），找到目标证书
• 右键选择所有任务 > 管理私钥
• 添加应用程序池账户，授予读取权限

3. 验证TLS版本与密码套件兼容性 #

Windows Server 2012 R2默认的TLS版本和密码套件可能与API依赖的加密组件不兼容，建议：

• 确保启用TLS 1.2（当前主流兼容版本）
• 启用包含TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384等符合.NET框架要求的密码套件

4. 查看日志定位问题 #

• 开启IIS的失败请求跟踪日志，捕获请求完整处理流程，排查认证或响应环节的隐性异常
• 查看Windows事件日志中的应用程序日志，寻找与证书、加密相关的错误信息

5. 确认证书加载正常 #

代码中加载证书的逻辑可能在服务器环境下失败但未抛出异常，可添加日志验证：

try
{
    var certPath = Path.Combine(Utility.AssemblyDirectory, ConfigurationManager.AppSettings["PublicCertificate"]);
    var cert = new X509Certificate2(certPath, ConfigurationManager.AppSettings["CertificatePassword"]);
    // 记录证书序列号等信息，确认加载成功
}
catch(Exception ex)
{
    // 记录证书加载失败的错误详情
}

内容的提问来源于stack exchange，提问作者Hosam