Windows容器内.NET构建无法忽略证书问题的解决求助

问题描述 #

在Windows主机上执行.NET Core构建时，虽有SSL证书警告但可成功完成；但在Windows容器中执行相同操作时，始终出现NU1301错误：

error NU1301: Unable to load the service index for source https://mycompany/repository/nuget.org-proxy/index.json.

确认该错误与证书相关，主机上执行Invoke-WebRequest访问NuGet源地址时返回：

Invoke-WebRequest https://mycompany/repository/nuget.org-proxy/index.json
Invoke-WebRequest: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot

在主机上设置忽略证书校验的环境变量后，构建成功并出现预期警告：

$env:DOTNET_SYSTEM_NET_HTTP_USE_SSL_CERTIFICATE=$false
dotnet build .\MyProj.Complete.sln

C:\Users\bongiorno.christian\MSG\MyProj\SUPPORT\XMI\SoaML\SoaML.csproj : warning NU1900: Error occurred while getting package vulnerability data: The SSL connection could not be established, see inner exception.

C:\Users\bongiorno.christian\MSG\MyProj\WPF\Tests\Company.UserManager.Tests\ModuleMain\ModuleMainPresentationModel.Tests.cs(45,30): warning CS0168: The variable 'ex' is declared but never used [C:\Users\bongiorno.christian\MSG\MyProj\WPF\Tests\Company.UserManager.Tests\Company.UserManager.Tests.csproj]
    23503 Warning(s)
    0 Error(s)

但在Docker容器内重复该流程时，即使设置相同环境变量，仍触发NU1301错误：

docker run -it -v .\:C:\Users\Administrator -w C:\Users\Administrator --entrypoint=pwsh mcr.microsoft.com/dotnet/sdk:8.0.411-windowsservercore-ltsc2022
PS C:\Users\Administrator> whoami
user manager\containeradministrator
PS C:\Users\Administrator> $env:DOTNET_SYSTEM_NET_HTTP_USE_SSL_CERTIFICATE=$false
PS C:\Users\Administrator> dotnet build .\MyProj.Complete.sln
...
C:\Users\Administrator\SUPPORT\XMI\MagicDraw_Packages\MagicDraw_Packages.csproj : error NU1301: Unable to load the service index for source https://company/repository/nuget.org-proxy/index.json. [C:\Users\Administrator\MyProj_Service.sln]
C:\Users\Administrator\SUPPORT\XMI\SoaML\SoaML.csproj : error NU1301: Unable to load the service index for source https://company/repository/nuget.org-proxy/index.json. [C:\Users\AdministratorMyProj_Service.sln]
C:\Users\Administrator\SUPPORT\XMI\SysML\SysML.csproj : error NU1301: Unable to load the service index for source https://company/repository/nuget.org-proxy/index.json. [C:\Users\Administrator\MyProj_Service.sln]
...

尝试的解决方案（均无效） #

尝试将组织的中间人证书安装到容器的系统信任库，步骤如下：

$hostname = "mycompany"  # 替换为实际服务器/域名
$port = 443                # 默认HTTPS端口

# 建立TCP连接
$tcpClient = New-Object System.Net.Sockets.TcpClient($hostname, $port)

# 创建SSL流，接受所有证书
$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream(), $false, ({ $true }))

# 执行SSL/TLS握手
$sslStream.AuthenticateAsClient($hostname)

# 获取远程证书
$cert = $sslStream.RemoteCertificate

# 关闭连接
$sslStream.Close()
$tcpClient.Close()

# 保存证书到文件
$certFilePath = "server-certificate.cer"
[System.IO.File]::WriteAllBytes($certFilePath, $cert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert))

# 导入证书到本地机器根证书库
Import-Certificate -FilePath "server-certificate.cer" -CertStoreLocation Cert:\LocalMachine\Root

# 输出结果
   PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\Root

Thumbprint                                Subject
----------                                -------
C9CCF8CD296BCEDEAD09DFC5ABC094D68122DC08  E=infosys@company.com, CN=ge-company, OU=IST, O="Company, Inc.", L=City, S=State, C=US

证书显示已成功导入，但再次执行构建仍出现相同的NU1301错误。

疑问 #

环境变量设置和证书安装两种方法在容器内均无效，遗漏了什么关键步骤？

内容的提问来源于stack exchange，提问作者Christian Bongiorno