.Net gRPC使用证书文件验证详细教程
继上一篇文章 玩转.Net gRPC简单使用详细教程
我这里找到一段脚本用来 生成证书文件
Write-Host "Creating Certificates for Self-Signed Testing"
Write-Host "Createing Root Certificate"
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
-Subject "CN=localhost" `
-FriendlyName "gRPCDemoRootCert" `
-KeyExportPolicy Exportable `
-HashAlgorithm sha256 `
-KeyLength 4096 `
-CertStoreLocation "cert://currentuser/My" `
-KeyUsageProperty Sign `
-KeyUsage CertSign `
-NotAfter (Get-Date).AddYears(1)
# Client Auth
Write-Host "Createing Client Auth Certificate"
$clientCert = New-SelfSignedCertificate -Type Custom `
-KeySpec Signature `
-Subject "CN=localhost" `
-KeyExportPolicy Exportable `
-FriendlyName "gRPCDemoClientCert" `
-HashAlgorithm sha256 `
-KeyLength 2048 `
-NotAfter (Get-Date).AddMonths(12) `
-CertStoreLocation "cert://currentuser/My" `
-Signer $cert `
-TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
# TLS Cert
Write-Host "Createing Web Server Certificate"
$webCert = New-SelfSignedCertificate -Type Custom `
-Subject "CN=localhost" `
-KeyExportPolicy Exportable `
-DnsName "localhost" `
-FriendlyName "gRPCDemoTlsCert" `
-HashAlgorithm sha256 `
-KeyLength 2048 `
-KeyUsage "KeyEncipherment", "DigitalSignature" `
-NotAfter (Get-Date).AddMonths(12) `
-CertStoreLocation "cert://currentuser/My" `
-Signer $cert
$PFXPass = ConvertTo-SecureString -String "P@ssw0rd!" -Force -AsPlainText
Write-Host "exporting Certificates to file"
Export-PfxCertificate -Cert $clientCert `
-Password $PFXPass `
-FilePath gRPCDemoSelfCert.pfx
Export-PfxCertificate -Cert $webCert `
-Password $PFXPass `
-FilePath gRPCDemoSslCert.pfx
-Subject :使用到的网站
-FriendlyName :名称
-CertStoreLocation 证书存储的位置
$PFXPass 设置的密码
以管理员身份执行:.\Generate_cert.ps1
可能会出现以下错误:
执行 set-executionpolicy remotesigned 即可
生成好后把 gRPCDemoSelfCert.pfx放到客户端,gRPCDemoSslCert.pfx放服务端目录下
文件属性都如图设置下:
打开certmgr证书
把root证书拖到受信任的根证书下
服务端中 Program.cs
public static IHostBuilder CreateHostBuilder(string[] args) =>
Host.CreateDefaultBuilder(args)
.ConfigureWebHostDefaults(webBuilder =>
{
webBuilder.UseStartup<Startup>();
webBuilder.ConfigureKestrel(opt =>
{
var cert = new X509Certificate2("gRPCDemoSslCert.pfx", "P@ssw0rd!");
opt.ConfigureHttpsDefaults(h=> {
h.ClientCertificateMode = Microsoft.AspNetCore.Server.Kestrel.Https.ClientCertificateMode.AllowCertificate;
h.CheckCertificateRevocation = false;
h.ServerCertificate = cert;
});
});
});
Startup.cs
services.AddAuthentication()
.AddCertificate(opt =>
{
opt.RevocationMode = X509RevocationMode.NoCheck;
opt.AllowedCertificateTypes = CertificateTypes.SelfSigned;
opt.Events = new CertificateAuthenticationEvents()
{
OnCertificateValidated = context =>
{
context.Success();
return Task.CompletedTask;
}
};
});
Nuget安装 Microsoft.AspNetCore.Authentication.Certificate
MyEmployeeService.cs 中头上加上:
[Authorize(AuthenticationSchemes =CertificateAuthenticationDefaults.AuthenticationScheme)]
public class MyEmployeeService : EmployeeServiceBase
接下来客户端
var cert = new X509Certificate2("gRPCDemoSelfCert.pfx", "P@ssw0rd!");
var handler = new HttpClientHandler();
handler.ClientCertificates.Add(cert);
var httpClient = new HttpClient(handler);
using var channel = GrpcChannel.ForAddress("https://localhost:5001",new GrpcChannelOptions {
HttpClient = httpClient
});
把之前的Jwt验证注释掉
public static async Task GetByNoAsync(EmployeeService.EmployeeServiceClient client)
{
//if (!NeedToken()|| await GetTokenAsync(client))
//{
var headers = new Metadata
{
{"Authorization",$"Bearer {_token}" }
};
var response = await client.GetByNoAsync(new GetByNoRequest()
{
No = 1994
}, headers);
Console.WriteLine(response);
//}
}
运行 dotnet run 1
大功告成!