在前一篇文章中,我们是把.NET 8应用读取SSL证书(X509)示例部署在App Service Windows环境中,那么如果部署在Linux环境,以及Linux Container中呢?
根据前文中的第一种方法,直接在把证书文件包含在源文件中,通过相对路径读取证书文件的方式,经测试,可以正常工作。
但是,对于第二种“通过指纹在系统证书库中查找证书 ”的方式,在Linux系统中,是不能使用 X509Store(StoreName.My, StoreLocation.CurrentUser) 中查找的方式。
经过测试验证,在App Service Linux( 包含Linux Container)证书页面上传的证书后,系统会把证书保存为文件。存储在 /var/ssl/ 文件夹中,可以通过ssh 方式查看:
在.NET 8代码中的正确读取私有证书 (.pfx)的代码示例:
public static string FindPfxbyThubmprintinLinux(string thumbprint) { if (string.IsNullOrEmpty(thumbprint)) return $"Certificate with thumbprint {thumbprint} was not found"; string finalPath = $"/var/ssl/private/{thumbprint}.p12"; var bytes2 = File.ReadAllBytes(finalPath); var cert = new X509Certificate2(bytes2); return cert.ToString(); }
注意:
附录:示例代码(.NET 8.0 顶级语句 program.cs)
using Microsoft.AspNetCore.Mvc; using Microsoft.Extensions.FileProviders; using System.Security.Cryptography.X509Certificates; var builder = WebApplication.CreateBuilder(args); // Add services to the container. var app = builder.Build(); // Configure the HTTP request pipeline. app.UseHttpsRedirection(); app.UseStaticFiles(new StaticFileOptions() { FileProvider = new PhysicalFileProvider(Path.Combine(Directory.GetCurrentDirectory(), "Images")), RequestPath = new PathString("/Images") }); app.MapGet("/loadpfxbyname", ([FromQuery(Name = "name")] string filename, [FromQuery(Name = "pwd")] string pwd) => { var content = pfxTesting.LoadPfx(filename, pwd); return content; }); app.MapGet("/loadpfx/{pwd}", (string pwd) => { var content = pfxTesting.LoadPfx(null, pwd); return content; }); app.MapGet("/findpfx/{certThumbprint}", (string certThumbprint) => { var content = pfxTesting.FindPfx(certThumbprint); return content; }); app.Run(); class pfxTesting { public static string LoadPfx(string? filename, string password = "") { try { if (filename == null) filename = "contoso.com.pfx"; var bytes = File.ReadAllBytes(filename); var cert = new X509Certificate2(bytes, password); return cert.ToString(); } catch (Exception ex) { return ex.Message; } } public static string FindPfx(string certThumbprint = "") { try { bool validOnly = false; using (X509Store certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser)) { certStore.Open(OpenFlags.ReadOnly); X509Certificate2Collection certCollection = certStore.Certificates.Find( X509FindType.FindByThumbprint, // Replace below with your certificate's thumbprint certThumbprint, validOnly); // Get the first cert with the thumbprint X509Certificate2 cert = certCollection.OfType<X509Certificate2>().FirstOrDefault(); if (cert is null) return FindPfxbyThubmprintinLinux(certThumbprint); //throw new Exception($"Certificate with thumbprint {certThumbprint} was not found"); return cert.ToString(); } } catch (Exception ex) { return ex.Message; } } public static string FindPfxbyThubmprintinLinux(string thumbprint) { if (string.IsNullOrEmpty(thumbprint)) return $"Certificate with thumbprint {thumbprint} was not found"; string finalPath = $"/var/ssl/private/{thumbprint}.p12"; var bytes2 = File.ReadAllBytes(finalPath); var cert = new X509Certificate2(bytes2); return cert.ToString(); } }
参考资料
在 Linux/Windows 容器中加载证书 : https://docs.azure.cn/zh-cn/app-service/configure-ssl-certificate-in-code#load-certificate-in-linuxwindows-containers
GetX509CertificateLinux(string thumbprint) :
Load Certificate on Linux Web App #19305 : https://github.com/MicrosoftDocs/azure-docs/issues/19305
【END】