MonoDevelop安装遇证书验证失败：解决方案分享

最近在Parrot 4.14.0-parrot13-amd64系统上编译安装MonoDevelop 5.12.0.266，顺利跑完./configure后执行make，结果直接卡在NuGet包还原环节，报了一堆SSL证书相关的错误，折腾了半天终于搞定，分享给遇到同样问题的朋友。

报错详情 #

执行make时的核心错误回溯如下：

Restoring NuGet package Microsoft.CodeAnalysis.VisualBasic.Workspaces.2.8.0-beta3-62728-05.
WARNING: Unable to find version '2.2.0' of package 'HumanizerCore'.
https://api.nuget.org/v3/index.json: Unable to load the service index for source https://api.nuget.org/v3/index.json.
An error occurred while sending the request Error: TrustFailure (A call to SSPI failed, see inner exception.)
A call to SSPI failed, see inner exception.
Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED at /home/c4ffrey/Downloads/mono-5.12.0.226/external/boringssl/ssl/handshake_client.c:1132
https://dotnet.myget.org/F/roslyn/api/v3/index.json: Unable to load the service index for source https://dotnet.myget.org/F/roslyn/api/v3/index.json.
An error occurred while sending the request Error: TrustFailure (A call to SSPI failed, see inner exception.)
A call to SSPI failed, see inner exception.
Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED ... at /home/c4ffrey/Downloads/mono-5.12.0.226/external/boringssl/ssl/handshake_client.c:1132
https://www.myget.org/F/azure-appservice/api/v3/index.json: Unable to load the service index for source https://www.myget.org/F/azure-appservice/api/v3/index.json.
An error occurred while sending the request Error: TrustFailure (A call to SSPI failed, see inner exception.)
A call to SSPI failed, see inner exception.
Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED at /home/c4ffrey/Downloads/mono-5.12.0.226/external/boringssl/ssl/handshake_client.c:1132
https://api.nuget.org/v3/index.json: Unable to load the service index for source https://api.nuget.org/v3/index.json.
An error occurred while sending the request Error: TrustFailure (A call to SSPI failed, see inner exception.)
A call to SSPI failed, see inner exception.
Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED at /home/c4ffrey/Downloads/mono-5.12.0.226/external/boringssl/ssl/handshake_client.c:1132

问题原因 #

Mono 5.12是比较旧的版本，它默认的证书存储没有同步系统最新的CA证书，而且内置的boringssl在和现代HTTPS服务握手时，会因为证书验证不通过导致连接失败，进而无法从NuGet源拉取依赖包。

解决方案 #

按照以下步骤操作，基本能解决问题：

1. 重置系统CA证书 #

先确保系统的证书存储是完整且最新的：

sudo apt update && sudo apt install --reinstall ca-certificates

2. 同步系统证书到Mono的证书存储 #

Mono有自己独立的证书存储，需要手动同步系统的CA证书：

sudo cert-sync /etc/ssl/certs/ca-certificates.crt

3. 临时切换Mono的TLS提供者（如果前两步无效） #

如果同步证书后还是报错，可以尝试切换Mono的TLS提供者为legacy模式，兼容旧的SSL/TLS配置：

export MONO_TLS_PROVIDER=legacy

设置完这个环境变量后，再重新执行make即可。

验证 #

执行完上述步骤后，重新运行make，NuGet应该能正常拉取依赖包，编译流程就能继续下去了。

内容的提问来源于stack exchange，提问作者c4ffrey