Replacement for adding certificate in .net6 app

huangapple
go评论87阅读模式
英文:

Replacement for adding certificate in .net6 app

问题

我正在努力替换从 .NET 4.8 升级到 .NET 6 时的现有添加证书代码。

以下是升级后的设置：

Program.cs

  1. private static async Task Main(string[] args)
  2. {
  3.     WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  5.     LoadConfiguration(builder);
  7.     var startup = new MyWebApp.Startup(builder.Configuration);
  8.     startup.ConfigureServices(builder.Services);
  10.     WebApplication app = builder.Build();        
  11.     await app.RunAsync().ConfigureAwait(false);
  12. }

Startup.cs

  1. public void ConfigureServices(IServiceCollection services)
  2. {
  3.     // 注册
  4.     RegisterServices(services);
  5.     // 注册
  6. }
  8. void RegisterServices(IServiceCollection services)
  9. {
  10.     // DbContext       
  12.     // 其他项目的注册
  13.     // Repo 等
  14.     services.RegisterClients(Configuration);
  15. }

Client CS Project

  1. //Extension
  2. public static class DIExtension
  3. {        
  4.     // 向给定的构建器注册客户端        
  5.     public static void RegisterClients(this IServiceCollection services, IConfiguration configuration)
  6.     {
  7.         //services.AddHttpClient
  9.         services.AddHttpClient<IMyClient, MyClient>("MPC", c =>
  10.         {
  11.             c.DefaultRequestHeaders.ExpectContinue = true;
  12.             c.BaseAddress = new Uri(configuration.GetConnectionString("Url"));
  13.         }).ConfigurePrimaryHttpMessageHandler(() =>
  14.             new HttpClientHandler().AddClientCertificate(configuration.GetValue<string>("MyCertificates:MyThumbprint")));
  15.     }
  16. }

HttpHandlerExt

  1. public static HttpClientHandler AddClientCertificate(this HttpClientHandler handler, string thumbPrint)
  2. {
  3.     handler = handler ?? new HttpClientHandler();
  5.     var cert = GetMyCertificate(thumbPrint);
  7.     if (cert == null)
  8.     {
  9.         return handler;
  10.     }
  12.     handler.ClientCertificateOptions = ClientCertificateOption.Manual;
  13.     handler.ClientCertificates.Add(cert);
  14.     return handler;
  15. }
  17. private static X509Certificate2 GetMyCertificate(string thumbPrint)
  18. {
  19.     var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
  20.     try
  21.     {
  22.         store.Open(OpenFlags.ReadOnly);
  23.         var col = store.Certificates.Find(X509FindType.FindByThumbprint, thumbPrint, false);
  24.         if (col == null || col.Count == 0)
  25.         {
  26.             throw new CertificateException($"Certificate was not found for thumbprint {thumbPrint}");
  27.         }
  28.         return col[0];
  29.     }
  30.     finally
  31.     {
  32.         store.Close();
  33.     }
  34. }
  1. // appsettings
  3. "MyCertificates": {
  4.     "MyThumbprint": "thumprintvalue"
  5. },

指纹值在 KV 的证书中可用。我不希望指纹值直接出现在 appsettings 中。如果需要额外信息，请告诉我，我尽可能提供了尽可能多的信息和代码。

英文:

I am struggling with replacing my existing add certificate code when upgrading from .net 4.8 to .net 6

Here is the set up post upgrade:

Program.cs

  1. private static async Task Main(string[] args)
  2.     {
  3.         WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
  5.         LoadConfiguration(builder);
  7.         var startup = new MyWebApp.Startup(builder.Configuration);
  8.         startup.ConfigureServices(builder.Services);
  10.         WebApplication app = builder.Build();        
  11.         await app.RunAsync().ConfigureAwait(false);
  12.     }

Startup.cs

  1. public void ConfigureServices(IServiceCollection services)
  2.         {
  3.             //register
  4.             RegisterServices(services);
  5.             //register
  6.         }
  8. void RegisterServices(IServiceCollection services)
  9.     {
  10.         // DbContext       
  12.         // Other project registrations
  13.         //Repo etc
  14.         services.RegisterClients(Configuration);
  15.     }

Client CS Project

  1. //Extension
  2. public static class DIExtension
  3.     {        
  4.         // Registers the clients to the given builder        
  5.         public static void RegisterClients(this IServiceCollection services, IConfiguration configuration)
  6.         {
  7.             //services.AddHttpClient
  9.             services.AddHttpClient&lt;IMyClient, MyClient&gt;(&quot;MPC&quot;, c =&gt;
  10.             {
  11.                 c.DefaultRequestHeaders.ExpectContinue = true;
  12.                 c.BaseAddress = new Uri(configuration.GetConnectionString(&quot;Url&quot;));
  13.             }).ConfigurePrimaryHttpMessageHandler(() =&gt;
  14.                 new HttpClientHandler().AddClientCertificate(configuration.GetValue&lt;string&gt;(&quot;MyCertificates:MyThumbprint&quot;)));
  15.         }
  16.     }

HttpHandlerExt

  1. public static HttpClientHandler AddClientCertificate(this HttpClientHandler handler, string thumbPrint)
  2.     {
  3.         handler = handler ?? new HttpClientHandler();
  5.         var cert = GetMyCertificate(thumbPrint);
  7.         if (cert == null)
  8.         {
  9.             return handler;
  10.         }
  12.         handler.ClientCertificateOptions = ClientCertificateOption.Manual;
  13.         handler.ClientCertificates.Add(cert);
  14.         return handler;
  15.     }
  17.     private static X509Certificate2 GetMyCertificate(string thumbPrint)
  18.     {
  19.         var store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
  20.         try
  21.         {
  22.             store.Open(OpenFlags.ReadOnly);
  23.             var col = store.Certificates.Find(X509FindType.FindByThumbprint, thumbPrint, false);
  24.             if (col == null || col.Count == 0)
  25.             {
  26.                 throw new CertificateException($&quot;Certificate was not found for thumbprint {thumbPrint}&quot;);
  27.             }
  28.             return col[0];
  29.         }
  30.         finally
  31.         {
  32.             store.Close();
  33.         }
  34.     }
  1. //appsettings
  3. &quot;MyCertificates&quot;: {
  4.     &quot;MyThumbprint&quot;: &quot;thumprintvalue&quot;
  5.   },

The thumprints are available in Certificates of KV. I do not want the thumprint value to be available directly in appsetting.
Please let me know if any additional information is required, I have tried to give as much information and code as possible from my end.

答案1

得分: 1

We can get the Thumbprint from the Azure Key Vault Certificate by using Azure Key Vault SDK.

  • We just need to pass the Key Vault URI.

安装 Azure.Identity 和 Azure.Security.KeyVault.Secrets NuGet 包

我的 .csproj 文件:

  1. <ItemGroup>
  2.     <PackageReference Include="Azure.Identity" Version="1.9.0" />
  3.     <PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.5.0" />
  4. </ItemGroup>
  • 首先，我们将以字节格式检索指纹，然后使用 X509Certificate2 进行转换

我的 Startup.cs 文件:

  1. using Azure.Identity;
  2. using Azure.Security.KeyVault.Secrets;
  3. using Microsoft.Extensions.Configuration;
  4. using System.Security.Cryptography.X509Certificates;
  6. internal class Startup
  7. {
  8.     private ConfigurationManager configuration;
  10.     public Startup(ConfigurationManager configuration)
  11.     {
  12.         this.configuration = configuration;
  13.     }
  14.     public void ConfigureServices(IServiceCollection services)
  15.     {
  16.         RegisterServices(services);
  17.     }
  19.     void RegisterServices(IServiceCollection services)
  20.     {       
  21.         string Thumbprint = GetCertificateThumbprint();
  22.     }
  24.     static string GetCertificateThumbprint()
  25.     {
  26.         var KVCred = new DefaultAzureCredential();
  27.         var KVURI = "https://harshukv4july.vault.azure.net/";
  29.         var client = new SecretClient(new Uri(KVURI), KVCred);
  31.         var CertName = "Certificare4July";
  32.         var secret = client.GetSecret(CertName);
  34.         byte[] ThumbPrintinBytes = Convert.FromBase64String(secret.Value.Value);
  36.         var KVCertificate = new X509Certificate2(ThumbPrintinBytes);
  37.         var CertThumbPrint = KVCertificate.Thumbprint;
  38.         Console.WriteLine($"Azure 证书的 Thumbprint  : { CertThumbPrint }");
  40.         return CertThumbPrint;
  41.     }
  42. }

输出:

Replacement for adding certificate in .net6 app

Replacement for adding certificate in .net6 app

验证 Key Vault Certificate 中的值:

Replacement for adding certificate in .net6 app

英文:

We can get the Thumbprint from the Azure Key Vault Certificate by using Azure Key Vault SDK.

  • We just need to pass the Key Vault URI.

Install the Azure.Identity and Azure.Security.KeyVault.Secrets NuGet Packages

My .csproj file:

  1.  &lt;ItemGroup&gt;
  2.     &lt;PackageReference Include=&quot;Azure.Identity&quot; Version=&quot;1.9.0&quot; /&gt;
  3.     &lt;PackageReference Include=&quot;Azure.Security.KeyVault.Secrets&quot; Version=&quot;4.5.0&quot; /&gt;
  4.  &lt;/ItemGroup&gt;
  • First, we will retrieve the Thumbprint in the bytes format, later convert it using X509Certificate2

My Startup.cs file:

  1. using Azure.Identity;
  2. using Azure.Security.KeyVault.Secrets;
  3. using Microsoft.Extensions.Configuration;
  4. using System.Security.Cryptography.X509Certificates;
  6. internal class Startup
  7. {
  8.     private ConfigurationManager configuration;
  10.     public Startup(ConfigurationManager configuration)
  11.     {
  12.         this.configuration = configuration;
  13.     }
  14.     public void ConfigureServices(IServiceCollection services)
  15.     {
  16.         RegisterServices(services);
  17.     }
  19.     void RegisterServices(IServiceCollection services)
  20.     {       
  21.         string Thumbprint = GetCertificateThumbprint();
  22.     }
  24.     static string GetCertificateThumbprint()
  25.     {
  26.         var KVCred = new DefaultAzureCredential();
  27.         var KVURI = &quot;https://harshukv4july.vault.azure.net/&quot;;
  29.         var client = new SecretClient(new Uri(KVURI), KVCred);
  31.         var CertName = &quot;Certificare4July&quot;;
  32.         var secret = client.GetSecret(CertName);
  34.         byte[] ThumbPrintinBytes = Convert.FromBase64String(secret.Value.Value);
  36.         var KVCertificate = new X509Certificate2(ThumbPrintinBytes);
  37.         var CertThumbPrint = KVCertificate.Thumbprint;
  38.         Console.WriteLine($&quot;Thumbprint from Azure Certificate  : { CertThumbPrint }&quot;);
  40.         return CertThumbPrint;
  41.     }
  42. }

OutPut:

Replacement for adding certificate in .net6 app

Replacement for adding certificate in .net6 app

Verify the value in Key Vault Certificate:

Replacement for adding certificate in .net6 app

huangapple
  • 本文由 发表于 2023年6月26日 19:01:26
  • 转载请务必保留本文链接：https://go.coder-hub.com/76556076.html
  • .net-6.0
  • appsettings
  • azure
  • azure-keyvault
  • client-certificates
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定