.Net Core 5使用aspnet:5.0-alpine镜像部署后无法连接Mongo Atlas DB

部署在Docker容器内的.NET Core 5 Web API项目无法连接Mongo Atlas DB，本地使用Kestrel运行时可正常连接并查询数据，无任何异常。使用的Docker运行时镜像为aspnet:5.0-alpine，已配置自签名开发证书实现SSL和HTTPS功能，相关配置运行正常，且已将.pfx证书文件拷贝到Docker容器内部。
该问题与MongoDB Atlas要求的TLS/SSL认证流程相关，当前使用的MongoDB.Driver版本为2.13.1，尝试过在连接数据库前加载SSL证书并配置到客户端设置中，依旧连接失败。MongoDB社区论坛及其他线上渠道仅找到问题描述类内容，无可用解决方案。
测试过多版修改后的连接代码均未成功，查询数据无报错，仅返回空数据集。

相关配置 #

Dockerfile #

FROM mcr.microsoft.com/dotnet/sdk:5.0-alpine AS build-env
WORKDIR /app

COPY ["Hammerhead.Common/Hammerhead.Common.csproj", "Hammerhead.Common/"]
COPY ["Hammerhead.Data/Hammerhead.Data.csproj", "Hammerhead.Data/"]
COPY ["Hammerhead.DataProvider/Hammerhead.DataProvider.csproj", "Hammerhead.DataProvider/"]
COPY ["Hammerhead.Services/Hammerhead.Services.csproj", "Hammerhead.Services/"]
COPY ["Hammerhead.App/Hammerhead.App.csproj", "Hammerhead.App/"]

RUN dotnet restore "Hammerhead.App/Hammerhead.App.csproj"

COPY . ./
RUN dotnet publish -c Release -o out

# Build runtime image
FROM mcr.microsoft.com/dotnet/aspnet:5.0-alpine as runtime

# SQL culture fix
RUN apk add icu-libs
ENV DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false

#ENV ASPNETCORE_URLS_ http://+:5000;https://+:5001

WORKDIR /app
COPY --from=build-env /app/out .

COPY ./Hammerhead.pfx ./

ENTRYPOINT ["dotnet", "Hammerhead.App.dll"]

docker-compose配置 #

version: "3"
services:
    rabbitmq:
        image: masstransit/rabbitmq:latest
        ports:
          - "5672:5672"
          - "15672:15672"
    seq:
        image: datalust/seq:latest
        ports:
          - 8081:80
          - 5341:5341
        environment:
          ACCEPT_EULA: "Y"
    trading-app:
        build:
            context: .
            dockerfile: Dockerfile-App
        ports:
            - 5000:80
            - 5001:443
        depends_on:
            - rabbitmq
            - seq
        environment:
            ASPNETCORE_URLS: "https://+;http://+"
            ASPNETCORE_ENVIRONMENT: "Development"
            ASPNETCORE_Kestrel__Certificates__Default__Password: "password"
            ASPNETCORE_Kestrel__Certificates__Default__Path: "./Hammerhead.pfx"
            ASPNET_CORE_HTTPS_PORT: 5001
            Serilog__WriteTo__1__Args__serverURL: "http://seq:5341"
            RABBIT_HOSTNAME: "rabbitmq"

MongoDB.Driver连接代码 #

string connectionString = "";
MongoClientSettings settings = MongoClientSettings.FromUrl(new MongoUrl(connectionString));
settings.SslSettings = new SslSettings() { EnabledSslProtocols = SslProtocols.Tls12 };
var mongoClient = new MongoClient(settings);

• 补充安装alpine镜像的CA根证书：alpine基础镜像默认未预装公共CA根证书，无法验证Mongo Atlas服务端TLS证书的合法性，会导致连接静默失败。在Dockerfile的runtime阶段添加如下配置：

# 在现有RUN apk add icu-libs命令后追加安装CA证书的逻辑
RUN apk add --no-cache icu-libs ca-certificates openssl
RUN update-ca-certificates
ENV DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=false

• 调整MongoDB连接配置：Kestrel使用的自签名证书和Mongo Atlas TLS认证无关，无需将该证书绑定到MongoDB客户端配置，修改连接代码如下：

string connectionString = "";
MongoClientSettings settings = MongoClientSettings.FromUrl(new MongoUrl(connectionString));
settings.SslSettings = new SslSettings() 
{ 
    EnabledSslProtocols = System.Security.Authentication.SslProtocols.Tls12,
    CheckCertificateRevocation = false
};
settings.AllowInsecureTls = false;
var mongoClient = new MongoClient(settings);

• 补全Mongo Atlas连接字符串参数：在连接字符串末尾追加&tls=true&tlsVersion=TLS1_2，强制驱动启用符合Mongo Atlas要求的TLS连接。
• 验证网络权限：确认Docker容器所在的主机公网IP已经添加到Mongo Atlas的IP访问白名单，可进入运行中的容器执行网络连通性测试，确认可以正常访问Mongo Atlas服务地址。

内容的提问来源于stack exchange，提问作者Victor Altadonna