.net 对于HTTPS，调用WebRequest总是失败。根据验证过程，远程证书无效_.net_Linux_Powershell_Ssl_Openssl

.net 对于HTTPS，调用WebRequest总是失败。根据验证过程，远程证书无效

.net linux powershell ssl openssl

.net 对于HTTPS，调用WebRequest总是失败。根据验证过程，远程证书无效,.net,linux,powershell,ssl,openssl,.net,Linux,Powershell,Ssl,Openssl,我试图在pwsh（Linux上）中使用Invoke-WebRequest，但总是失败。下面是一个例子： Invoke-WebRequest https://www.google.com 站点/URL不重要，如果它使用HTTPS，我将得到错误。在Windows计算机上，完全相同的脚本可以正常工作 $pVersionTable > Name Value > ---- ----

我试图在

pwsh

（Linux上）中使用Invoke-WebRequest，但总是失败。下面是一个例子：

    Invoke-WebRequest https://www.google.com

站点/URL不重要，如果它使用HTTPS，我将得到错误。在Windows计算机上，完全相同的脚本可以正常工作

$pVersionTable

> Name                           Value
> ----                           -----
> PSVersion                      7.0.0
> PSEdition                      Core
> GitCommitId                    7.0.0
> OS                             Linux 3.10.0-514.21.1.el7.x86_64 #1 SMP Thu May 25 17:04:51 UTC 2017
> Platform                       Unix
> PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
> PSRemotingProtocolVersion      2.3
> SerializationVersion           1.1.0.1
> WSManStackVersion              3.0

dotnet--版本

3.1.403

openssl版本

OpenSSL 1.0.1e-fips 2013年2月11日

我知道可以在Invoke WebRequest方法上禁用SSL验证，但我真的宁愿避免它，而且，在执行

dotnet restore

如果我使用

curlhttps://www.google.com

它似乎工作正常。我的理解是pwsh使用dotnet实际发出这个webrequest，dotnet使用openssl进行https…这可能都是错误的，但我一直在尝试使用openssl调试它

当我使用openssl s_client-connect www.google.com:443时，似乎一切都很好。我可以看到证书链：

> Certificate chain  
>  0 s:/C=US/ST=California/L=Mountain View/O=Google LLC/CN=www.google.com    
>    i:/C=US/O=Google Trust Services/CN=GTS CA 1O1
>  1 s:/C=US/O=Google Trust Services/CN=GTS CA 1O1    
>    i:/OU=GlobalSign Root CA - R2/O=GlobalSign/CN=GlobalSign

和返回代码0（确定）

如果我在

.ps1

脚本中捕捉到异常，我可以看到更多信息：

The remote certificate is invalid according to the validation procedure.
System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
   at System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Security.SslStream.ThrowIfExceptional()
   at System.Net.Security.SslStream.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslStream.EndProcessAuthentication(IAsyncResult result)
   at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)
   at System.Net.Security.SslStream.<>c.<AuthenticateAsClientAsync>b__65_1(IAsyncResult iar)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean allowHttp2, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncUnbuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.PowerShell.Commands.WebRequestPSCmdlet.GetResponse(HttpClient client, HttpRequestMessage request, Boolean keepAuthorization)
   at Microsoft.PowerShell.Commands.WebRequestPSCmdlet.ProcessRecord()

我没有看到openssl的_客户机的等效版本，但运行strace-e openssl s_客户机-connect |&grep open显示：

open("/etc/pki/tls/openssl.cnf", O_RDONLY) = 3
open("/etc/pki/tls/cert.pem", O_RDONLY) = 3

但是我没有看到

pwsh

试图访问我安装的任何根ca。当我在线搜索时，我看到很多人说Linux上的dotnet core使用OpenSSL，我应该查看

OpenSSL.cnf

文件-但是当我从命令行使用OpenSSL时，它似乎起作用了

再一次-任何帮助都将不胜感激。似乎pwsh没有使用我拥有的证书？

因为您要求的是指针而不是解决方案：几乎可以肯定的是，powershell不知道在哪里可以找到要信任的证书颁发机构的信任库。了解如何告诉它信任存储在哪里，或者了解如何用特定证书告诉invoke webrequest，这是我的出发点。

这绝对正确-谢谢。为了我的目的，使用环境变量SSL\u CERT\u FILE/SSL\u CERT\u DIR解决了这个问题。感谢您使用环境变量发回。我敢肯定，当我遇到同样的问题时，我会在一两年后回到这篇文章！

* Connected to www.google.com (74.125.195.105) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSL connection using TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

open("/etc/pki/tls/openssl.cnf", O_RDONLY) = 3
open("/etc/pki/tls/cert.pem", O_RDONLY) = 3