.NET Core 使用 HttpClient SSL 请求出错的解决办法

问题

使用 http client 请求 https 的 api 时出现 the certificate cannot be verified up to a trusted certification authority 异常，并且证书已经传入。

下面就是问题代码：

public class program
{
    public static void main(string[] args)
    {
        var url = @"https://xxx.xxx.xxx.xxx:xxxx/xxx-web/services/xxxx?wsdl";

        var handler = new httpclienthandler
        {
            clientcertificateoptions = clientcertificateoption.manual,
            clientcertificates =
            {
                new x509certificate2(@"e:\cert\roottrust.cer","11111111"),
                new x509certificate2(@"e:\cert\middletrust.cer","11111111"),
                new x509certificate2(@"e:\cert\wskey.pfx","ws654321")
            }
        };
        
        var webrequest = new httpclient(handler);
        var result = webrequest.getstringasync(url).getawaiter().getresult();
        console.writeline(result);
    }
}

原因

因为在发出 https 请求的时候，httpclient 都会检查 ssl 证书是否合法。如果不合法的话，就会导致抛出异常信息，而对方给出的证书是自签发的测试接口的证书，所以不是一个合法的 ssl 证书。

解决

在 httpclienthandler 当中会有一个 servercertificatecustomvalidationcallback 事件，该事件用于判定证书验证是否通过。我们可以挂接该事件，然后逻辑编写为直接返回 true 结果，这样就会忽略掉证书异常的情况。

最新的代码如下：

public class program
{
    public static void main(string[] args)
    {
        var url = @"https://xxx.xxx.xxx.xxx:xxxx/xxx-web/services/xxxx?wsdl";

        var handler = new httpclienthandler
        {
            servercertificatecustomvalidationcallback = (message, certificate2, arg3, arg4) => true, 
            clientcertificateoptions = clientcertificateoption.manual,
            clientcertificates =
            {
                new x509certificate2(@"e:\cert\roottrust.cer","11111111"),
                new x509certificate2(@"e:\cert\middletrust.cer","11111111"),
                new x509certificate2(@"e:\cert\wskey.pfx","ws654321")
            }
        };
        
        var webrequest = new httpclient(handler);
        var result = webrequest.getstringasync(url).getawaiter().getresult();
        console.writeline("xx");
    }
}