.NET C# “根據驗證程序，遠程證書無效”

Question

我在使用HttpClient REST撥打 REST 時遇到問題。

1. 我有一個在 .NET Core 中開發的應用程序，它在 Windows 和 Linux 機器上運行。
2. 此應用程序調用https://dev.example.com/ 。
3. SSL 證書有效，並且具有所有必需的中間證書和鏈式證書。
4. 此證書是為域為*.example.com的所有 URL 頒發的。 這意味着相同的證書應該適用於dev.example.com 、 test.example.com 、 stage.example.com以及prod.example.com 。
5. 當我們在 Windows 10 機器上執行時，.NET 核心應用程序運行良好。 然而，當我們在 Windows 7 機器上執行它時，我們會遇到問題。

我還嘗試在使用HttpClientHandler class 發送請求時使用證書文件 (.cer)。在 Windows 7 機器上，我還嘗試下載證書並將其添加到受信任的證書中。 但是，我仍然面臨這個問題。

下面是堆棧跟蹤。

ERROR ======================= :: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Security.SslState.ThrowIfExceptional()
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)
   at System.Net.Security.SslStream.<>c.<AuthenticateAsClientAsync>b__47_1(IAsyncResult iar)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.CreateConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.WaitForCreatedConnectionAsync(ValueTask`1 creationTask)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)

更新

我嘗試用IE web瀏覽器獲取證書信息。

在Windows 10系統上，可以看到完整的證書信息。 但是，在 Windows 7 系統上，我可以看到消息為

證書無法驗證到受信任的證書頒發機構

Answer 1

最后，我能夠解決這個問題。

我發現該服務是由 Windows 7 系統上的一個用戶創建的，但是，它正在被另一個用戶調用。

我嘗試通過控制台（命令提示符）執行該應用程序，發現該應用程序能夠通過 HTTPS 進行調用。但是，當我們將其作為服務運行時，它無法執行此操作。

使用 sc 命令創建時修改了服務配置。

sc create <servicename> binPath= <path/to/your/appexe.exe> obj= <username> password= <password>

我們通過此更改使應用程序能夠通過 HTTPS 進行呼叫。