c# - 有没有办法在 ASP.NET Core 3.1 应用程序端点中应用服务器 SSL 证书？

Question

我在我的 Ubuntu VPS 上配置了 Nginx。证书在前端端点 (*.html) 上完美运行，但我无法从任何客户端应用程序从我的 ASP.NET Core API 获取数据。例如，尝试使用以下 python 代码获取数据:

import requests
import json
data = {"somevariable" : "someData"}
url='https://myDNS:myPort/myEndpoint'
r = requests.post(url, json=data)

返回以下错误消息:

SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)'))

我的目标是使用来自任何客户端的 Nginx 生成的证书 (HTTPS) 与 ASP.NET 端点进行通信。我尝试了以下文档，但似乎都没有解决我的问题。

https://docs.microsoft.com/cs-cz/aspnet/core/host-and-deploy/linux-nginx?view=aspnetcore-3.1#configure-nginx

https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?tabs=aspnetcore2x&view=aspnetcore-3.1#when-to-use-kestrel-with-a-reverse-proxy

应用程序启用了 SSL，并且 Program.cs 如下所示:

public class Program
    {
        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    //webBuilder.UseUrls("http://0.0.0.0:5001");
                    webBuilder.UseStartup<Startup>();
                    webBuilder.UseKestrel(options =>
                    {
                        options.Listen(IPAddress.Loopback, 5000); //Should listen on https://MyDNS:5000/
                    });
                });
    }

我还在 Startup.cs 的同一端口上使用 HttpsRedirection，如下所示:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            app.UseHttpsRedirection();
            //.... rest of configuration
        }
 public void ConfigureServices(IServiceCollection services)
        {
            //...
            services.AddHttpsRedirection(options =>
            {
                options.RedirectStatusCode = StatusCodes.Status307TemporaryRedirect;
                options.HttpsPort = 5000;
            });
            //...
      }

我会非常感谢任何答案。

Answer 1

我认为这是 nginex 配置问题。
尝试将配置修改为:

server 
{ 
    listen 443 ssl; 
    server_name api.vojtechpetrasek.com; 

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      # Fix the “It appears that your reverse proxy set up is broken" error.
      proxy_pass          http://localhost:5000;
      proxy_read_timeout  90;

      proxy_redirect      http://localhost:5000 https://api.vojtechpetrasek.com;
    }

#.... managed by Certbot 
} 

您的 asp.net 应用程序应该在 http://localhost:5000 上运行
(在linux上可以通过“链接http://localhost:5000”进行测试)

好教程
https://www.digitalocean.com/community/tutorials/how-to-configure-nginx-with-ssl-as-a-reverse-proxy-for-jenkins