azure - .Net Core MVC 中安全服务请求的双向 SSL X509 证书位置 - Azure 服务托管应用程序

Question

我一直在使用 x509 证书，以便向某些数据服务发出安全请求。它们需要双向 SSL 身份验证，因此我已将带有私钥的“沙盒”证书 (.crt) 转换为受密码保护的 .p12 文件。

这是第一个问题:我应该将该 .p12 文件放在哪里，以便我的应用程序在部署到 Azure(使用 DevOps)后可以读取该文件，但仍安全存储？我可以使用 Azure Key Vault 吗？

第二个问题是，在我的开发环境中，我无法在发出请求后建立 SSL 绑定(bind)(使用 .p12 绝对路径):

这是我正在使用的代码:

void GetATMs()
    {
        string requestURL = "https://sandbox.api.visa.com/globalatmlocator/v1/localatms/atmsinquiry";
        string userId = "MyUserId";
        string password = "MyPassword";
        string p12certificatePath = "C:\\Code\\projects\\project\\\\Clients\\PaymentGateways\\Visa\\Certs\\TC_keyAndCertBundle.p12";
        string p12certificatePassword = "CertPassword";
        string postData = @"{""wsRequestHeaderV2"": { ""requestTs"": ""2018-11-06T03:16:18.000Z"", ""applicationId"": ""VATMLOC"", ""requestMessageId"": ""ICE01-001"", ""userId"": ""CDISIUserID"", ""userBid"": ""10000108"", ""correlationId"": ""909420141104053819418"" }, ""requestData"": { ""culture"": ""en-US"", ""distance"": ""20"", ""distanceUnit"": ""mi"", ""metaDataOptions"": 0, ""location"": { ""address"": null, ""placeName"": ""700 Arch St, Pittsburgh, PA 15212"", ""geocodes"": null }, ""options"": { ""range"": { ""start"": 10, ""count"": 20 }, ""sort"": { ""primary"": ""city"", ""direction"": ""asc"" }, ""operationName"": ""or"", ""findFilters"": [ { ""filterName"": ""OPER_HRS"", ""filterValue"": ""C"" } ], ""useFirstAmbiguous"": true } } }";

        HttpWebRequest request = WebRequest.Create(requestURL) as HttpWebRequest;
        request.Method = "POST";
        // Add headers
        string authString = userId + ":" + password;
        var authStringBytes = System.Text.Encoding.UTF8.GetBytes(authString);
        string authHeaderString = Convert.ToBase64String(authStringBytes);
        request.Headers["Authorization"] = "Basic " + authHeaderString;
        // Add certificate
        var certificate = new X509Certificate2(p12certificatePath, p12certificatePassword);

        request.ClientCertificates.Add(certificate);
        request.Accept = "application/json";
        var data = Encoding.ASCII.GetBytes(postData);
        request.ContentLength = data.Length;
        // Get the request stream.  
        Stream dataStream = request.GetRequestStream();
        // Write the data to the request stream.  
        dataStream.Write(data, 0, data.Length);
        // Close the Stream object.  
        dataStream.Close();
        // Get the response.  
        WebResponse response = request.GetResponse();
        // Display the status.  
        Console.WriteLine(((HttpWebResponse)response).StatusDescription);
        // Get the stream containing content returned by the server.  
        dataStream = response.GetResponseStream();
        // Open the stream using a StreamReader for easy access.  
        StreamReader reader = new StreamReader(dataStream);
        // Read the content.  
        string responseFromServer = reader.ReadToEnd();
        // Display the content.  
        Console.WriteLine(responseFromServer);
        // Clean up the streams.  
        reader.Close();
        dataStream.Close();
        response.Close();

我在这里缺少什么？

它以下列方式失败:

An unhandled exception occurred while processing the request.
Win32Exception: The credentials supplied to the package were not recognized
System.Net.SSPIWrapper.AcquireCredentialsHandle(SSPIInterface secModule, string package, CredentialUse intent, SCHANNEL_CRED scc)

HttpRequestException: The SSL connection could not be established, see inner exception.
System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)

WebException: The SSL connection could not be established, see inner exception. The credentials supplied to the package were not recognized
System.Net.HttpWebRequest.GetResponse()

我们的域有通配符 SSL。它们有什么不同吗？它是否可以在 Visa 仪表板中注册并用于发出安全请求，因为它是由受信任的 CA 机构签名的？

Answer 1

嗯，是的。根据 @dagope 建议，我已将证书上传到 Azure 上的 key 管理并通过 SDK 访问它。这也是 Azure 上 key /证书管理的最佳实践。