C#grpc服务器端唯一证书

Question

有人知道如何配置grpc使用服务器端证书(不是默认的dev证书)的例子吗？所以没有客户端证书，只有一个服务器端证书来加密通道。

我创建了一个自签名pfx，并将其导入受信任的根证书颁发机构。使用以下配置atm:

            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.ConfigureKestrel(o =>
                {
                    o.ConfigureHttpsDefaults(x =>
                    {
                        x.ClientCertificateMode = ClientCertificateMode.NoCertificate;
                        x.ServerCertificate = GetCertificate(StoreLocation.LocalMachine, StoreName.CertificateAuthority, "<thumbprint>");
                    });
                });
                webBuilder.UseStartup<Startup>();
            });

  "profiles": {
"Aeternum.ServiceHost": {
  "commandName": "Project",
  "dotnetRunMessages": "true",
  "launchBrowser": false,
  "applicationUrl": "https://localhost:15425",  //the pfx was created for localhost
  "environmentVariables": {
    "ASPNETCORE_ENVIRONMENT": "Development"
  }
}

  "Kestrel": {
"Url": "https://*:15425",
"EndpointDefaults": {
  "Protocols": "Http2"
}

在这个客户身上尝试一下(我很确定ChannelCredentials。没有安全感是不正确的，但是我不知道在那里还能做什么):

        var channel = new Channel(rootUri.Host, _rootUri.Port, ChannelCredentials.Insecure);
        return new AuthServiceV1.AuthServiceV1Client(channel);

目前，我在客户端得到这个异常（没有ssl，一切似乎都很好）：

Status(StatusCode= "不可用"，Detail= "无法连接到所有地址"，DebugException="Grpc。core . internal . coreerrordetailexception:{ " created ":" @ 1628428855.871000000 "，" description ":"选取子通道失败"，"文件":"......\ src \ core \ ext \ filters \ client _ channel \ client _ channel . cc "，" file_line":3009，" referenced _ errors ":[{ " created ":" @ 1628428855.871000000 "，" description ":"连接所有地址失败"，" file ":"......\ src \ core \ ext \ filters \ client _ channel \ lb _ policy \ pick _ first \ pick _ first . cc "，" file_line":398，" grpc_status":14}]}))

谢谢。

Answer 1

所以我找到了解决办法。

服务器:

  "CertThumbprint": "<certificate thumbprint>",
  "Kestrel": {
    "EndpointDefaults": {
      "Url": "https://*:15425",
      "Protocols": "Http2"
    }
  },

        .ConfigureWebHostDefaults(webBuilder =>
        {
            webBuilder.ConfigureKestrel((context, options) =>
            {
                options.ConfigureHttpsDefaults(x =>
                {
                    var thumbprint = context.Configuration["CertThumbprint"];
                    x.ClientCertificateMode = ClientCertificateMode.NoCertificate;
                    x.ServerCertificate = GetCertificate(StoreLocation.LocalMachine, StoreName.CertificateAuthority, thumbprint);
                });
            });
            webBuilder.UseStartup<Startup>();
        });

在客户端中，不要自己创建通道，而是使用grpc客户端工厂：

    services.AddGrpcClient<AuthServiceV1.AuthServiceV1Client>((sp, o) =>
        {
            var configuration = sp.GetRequiredService<IConfiguration>();
            var serviceUrl = configuration["ServiceUrl"];
            o.Address = new Uri(serviceUrl);
        })
        .AddInterceptor<ClientInterceptor>();

services.AddTransient<AuthService>();

最后是服务类本身：

    public class AuthService
    {
        public AuthService(AuthServiceV1.AuthServiceV1Client client)
        {
            _client = client;
        }

        private readonly AuthServiceV1.AuthServiceV1Client _client;

        ...
    }
}