通过VPN隧道使用AzCopy访问私有端点时证书验证失败

问题场景 #

尝试使用AzCopy将本地文件上传至启用私有链接的Azure Blob存储，编写的PowerShell代码如下：

$localFilePath = "C:\Code\AzCopy\testfile.bak"
$containerUrl = "https://storageaccountname01.privatelink.blob.core.windows.net/databasebackups"  

$sasToken = "sv=2024-01-01&ss=bfat&srt=aa&sp=sds3sdd&se=2026-19-01T21:50:38Z&st=2025-15-12T13:50:38Z&spr=https&sig=thisisnotrealandonlytofoolyou%3D"

$today = (Get-Date).ToString("yyyy-MM-dd")
$destinationUrl = "$containerUrl/$today/$(Split-Path -Leaf $localFilePath)?$sasToken"

Start-Process "./azcopy" -ArgumentList @(
    "copy", 
    $localFilePath, 
    $destinationUrl, 
    "--overwrite=true", 
    "--from-to=LocalBlob", 
    "--trusted-microsoft-suffixes=storageaccountname01.privatelink.blob.core.windows.net;*.privatelink.blob.core.windows.net;privatelink.blob.core.windows.net",
    "--log-level=debug"
) -NoNewWindow -Wait

执行后报错：

Put "https://storageaccountname01.privatelink.blob.core.windows.net/databasebackups/2025-05-12%2Ftestfile.bak?se=2025-05-12T20%3A07%3A15Z&sig=-REDACTED-&sp=-REDACTED-&spr=https&srt=c&ss=bfqt&st=2025-05-12T12%3A07%3A15Z&sv=2024-11-04": tls: failed to verify certificate: x509: certificate is valid for *.blob.core.windows.net, *.gvx01prdstr02a.store.core.windows.net, *.blob.storage.azure.net, *.z1.blob.storage.azure.net, *.z2.blob.storage.azure.net, *.z3.blob.storage.azure.net, *.z4.blob.storage.azure.net, *.z5.blob.storage.azure.net, *.z6.blob.storage.azure.net, *.z7.blob.storage.azure.net, *.z8.blob.storage.azure.net, *.z9.blob.storage.azure.net, *.z10.blob.storage.azure.net, *.z11.blob.storage.azure.net, *.z12.blob.storage.azure.net, *.z13.blob.storage.azure.net, *.z14.blob.storage.azure.net, *.z15.blob.storage.azure.net, *.z16.blob.storage.azure.net, *.z17.blob.storage.azure.net, *.z18.blob.storage.azure.net, *.z19.blob.storage.azure.net, *.z20.blob.storage.azure.net, *.z21.blob.storage.azure.net, *.z22.blob.storage.azure.net, *.z23.blob.storage.azure.net, *.z24.blob.storage.azure.net, *.z25.blob.storage.azure.net, *.z26.blob.storage.azure.net, *.z27.blob.storage.azure.net, *.z28.blob.storage.azure.net, *.z29.blob.storage.azure.net, *.z30.blob.storage.azure.net, *.z31.blob.storage.azure.net, *.z32.blob.storage.azure.net, *.z33.blob.storage.azure.net, *.z34.blob.storage.azure.net, *.z35.blob.storage.azure.net, *.z36.blob.storage.azure.net, *.z37.blob.storage.azure.net, *.z38.blob.storage.azure.net, *.z39.blob.storage.azure.net, *.z40.blob.storage.azure.net, *.z41.blob.storage.azure.net, *.z42.blob.storage.azure.net, *.z43.blob.storage.azure.net, *.z44.blob.storage.azure.net, *.z45.blob.storage.azure.net, *.z46.blob.storage.azure.net, *.z47.blob.storage.azure.net, *.z48.blob.storage.azure.net, *.z49.blob.storage.azure.net, *.z50.blob.storage.azure.net, not storageaccountname01.privatelink.blob.core.windows.net

已排查：VPN隧道可访问其他资源、路由正常；DNS解析正确，ping存储账户FQDN可获取正确私有IP；尝试--trusted-microsoft-suffixes参数无效，询问是否为防火墙拦截或其他原因。

错误原因 #

这个错误不是防火墙拦截导致，核心原因是Azure Blob存储的TLS证书仅包含*.blob.core.windows.net等公共域名的SAN（主题备用名称），而私有链接的FQDNstorageaccountname01.privatelink.blob.core.windows.net不在证书的信任列表中，导致TLS握手时证书验证失败。

--trusted-microsoft-suffixes参数的作用是允许AzCopy信任微软旗下的特定域名后缀，并非用于适配私有链接的证书验证场景，因此无法解决该问题。

解决方法 #

方法1：通过Hosts文件映射公共域名到私有IP（推荐生产环境） #

1. 编辑本地C:\Windows\System32\drivers\etc\hosts文件，添加一行映射（替换<私有IP>为实际获取到的存储账户私有IP）：

   <私有IP> storageaccountname01.blob.core.windows.net
   

2. 修改PowerShell代码中的$containerUrl为存储账户的公共域名：

   $containerUrl = "https://storageaccountname01.blob.core.windows.net/databasebackups"
   

3. 保持其他参数不变，重新执行脚本。

原理：通过Hosts强制公共域名指向私有IP，既满足TLS证书对域名的要求，又确保流量通过私有链接传输。

方法2：禁用证书验证（仅测试环境使用） #

在AzCopy的参数列表中添加--disable-certificate-validation，跳过证书验证步骤：

Start-Process "./azcopy" -ArgumentList @(
    "copy", 
    $localFilePath, 
    $destinationUrl, 
    "--overwrite=true", 
    "--from-to=LocalBlob", 
    "--disable-certificate-validation",
    "--log-level=debug"
) -NoNewWindow -Wait

注意：此方法会降低传输安全性，禁止在生产环境使用。

内容的提问来源于stack exchange，提问作者JensB