Service Fabric无状态应用Kestrel证书轮换无重启加载方案咨询

你当前代码的核心问题是Kestrel启动时仅一次性读取证书并固定绑定，后续不会主动刷新证书存储，要实现不重启服务加载新轮换的证书，按以下方案修改：

1. 替换固定证书绑定为动态证书选择回调 #

Kestrel原生支持TLS握手时动态选择证书，不用在服务启动时就固定证书实例，修改CreateServiceInstanceListeners中的Kestrel配置：

protected override IEnumerable<ServiceInstanceListener> CreateServiceInstanceListeners()
{
    return new ServiceInstanceListener[]
    {
        new ServiceInstanceListener(serviceContext =>
            new KestrelCommunicationListener(serviceContext, "ServiceEndpoint", (url, listener) =>
            {
                ServiceEventSource.Current.ServiceMessage(serviceContext, $"Starting Kestrel on {url}");
                
                return new WebHostBuilder()
                            .UseKestrel(opt =>
                            {
                                int port = serviceContext.CodePackageActivationContext.GetEndpoint("ServiceEndpoint").Port;
                                opt.Listen(IPAddress.IPv6Any, port, listenOptions =>
                                {
                                    // 改用动态证书选择回调，每次TLS握手时按需获取最新证书
                                    listenOptions.UseHttps(httpsOpts =>
                                    {
                                        httpsOpts.ServerCertificateSelector = (connectionContext, sniName) =>
                                        {
                                            return CertificateHelper.GetValidCertificate();
                                        };
                                    });
                                    listenOptions.NoDelay = true;
                                });
                            }
                            // 其余原有配置保持不变
                            );
            }))
    };
}

2. 增加证书缓存逻辑避免性能损耗 #

每次握手都读证书存储会有性能开销，新增证书缓存逻辑，设置合理的缓存有效期（比如5分钟），缓存过期后自动重新读取证书存储获取最新证书：

public static class CertificateHelper
{
    private static X509Certificate2 _cachedCert;
    private static DateTime _cacheExpiryTime = DateTime.MinValue;
    private const int CacheExpiryMinutes = 5;
    private static readonly object _lockObj = new object();

    public static X509Certificate2 GetValidCertificate()
    {
        // 缓存未过期直接返回缓存证书
        if (_cachedCert != null && DateTime.Now < _cacheExpiryTime)
        {
            return _cachedCert;
        }

        lock (_lockObj)
        {
            // 双重校验避免多线程重复加载
            if (_cachedCert != null && DateTime.Now < _cacheExpiryTime)
            {
                return _cachedCert;
            }

            string subjectCommonName = Environment.GetEnvironmentVariable("certsubject");
            X509Certificate2 certForApp = null;
            using (var store = new X509Store(StoreName.My, StoreLocation.LocalMachine))
            {
                store.Open(OpenFlags.OpenExistingOnly | OpenFlags.ReadOnly);
                var certCollection = store.Certificates;

                foreach (var enumeratedCert in certCollection)
                {
                    if (StringComparer.OrdinalIgnoreCase.Equals(subjectCommonName, enumeratedCert.GetNameInfo(X509NameType.SimpleName, forIssuer: false))
                      && DateTime.Now < enumeratedCert.NotAfter
                      && DateTime.Now >= enumeratedCert.NotBefore)
                    {
                        if (certForApp == null)
                        {
                            certForApp = enumeratedCert;
                        }
                        else
                        {
                            if (enumeratedCert.NotBefore > certForApp.NotBefore)
                            {
                                certForApp = enumeratedCert;
                            }
                        }
                    }
                }

                if (certForApp == null)
                {
                    throw new Exception($"Could not find a match for a certificate with subject 'CN={subjectCommonName}'.");
                }
            }

            // 更新缓存和过期时间
            _cachedCert = certForApp;
            _cacheExpiryTime = DateTime.Now.AddMinutes(CacheExpiryMinutes);
            return certForApp;
        }
    }
}

3. 注意事项 #

• 确保新安装的证书私钥权限已分配给Service Fabric运行时使用的服务账户，否则会出现证书读取失败的问题
• 如果需要更快的证书生效速度，可以调小缓存有效期，或者新增后台定时任务主动检测证书更新，检测到新证书后直接清空缓存即可

内容的提问来源于stack exchange，提问作者Dip