证书验证失败：验证证书时客户端证书验证失败

我正在尝试获得相互客户端认证以在 Azure 中工作。我正在使用以下配置运行一个网络应用程序：

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        services
            .AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
        .AddCertificate();

        services.AddCertificateForwarding(options =>
            options.CertificateHeader = "X-ARR-ClientCert");

        services.AddHttpClient();
        services.AddControllers();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseAuthentication();
        app.UseHttpsRedirection();
        app.UseRouting();
        app.UseCertificateForwarding();
        app.UseAuthorization();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
}

作为扩展，我添加了这样的内容，以便 Web 应用程序将客户端证书发送到我的应用程序。当我部署它时，一切都很好。我前面有 cloudflare 并启用了 Origin Pull，我可以验证客户端证书是否已发送。我可以看到，当我尝试直接访问 azurewebsites.net 域上的 Web 应用程序时，我的浏览器要求提供证书。如果我尝试访问 Cloudflare，它将显示该网页。我以为这可行，但是当我检查日志时，我得到了这个：

2020-07-02 13:30:52.711 +00:00 [信息] Microsoft.AspNetCore.Hosting.Diagnostics：请求启动 HTTP/1.1 GET https://[已删除]/api/ping

2020-07-02 13:30:52.718 +00:00 [Trace] Microsoft.AspNetCore.HostFiltering.HostFilteringMiddleware：允许所有主机。

2020-07-02 13:30:53.107 +00:00 [警告] Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler：证书验证失败，主题为 OU=Origin Pull，O="Cloudflare, Inc."，L=旧金山，S=加利福尼亚州，C=US.UntrustedRoot 已处理但终止于受信任提供商不信任的根证书的证书链。 ReplicationStatusUnknown 吊销功能无法检查证书的吊销。OfflineReplication 吊销功能无法检查吊销，因为吊销服务器已脱机。

2020-07-02 13:30:53.107 +00:00 [信息] Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler：证书未经身份验证。失败消息：客户端证书验证失败。

2020-07-02 13:30:53.110 +00:00 [调试] Microsoft.AspNetCore.Routing.Matching.DfaMatcher：为请求路径“/api/ping”找到 1 个候选者

看来客户端证书未被接受。应该是吗？我的意思是，它是 Cloudflare。我的设置有问题吗？我应该在我这边安装一些额外的东西吗？我在这里浏览了本指南：https://support.cloudflare.com/hc/en-us/articles/204899617-Authenticated-Origin-Pulls https://support.cloudflare.com/hc/en-us/articles/204899617-Authenticated-Origin-Pulls并且它没有提及任何有关额外安装证书的内容。我应该在网络应用程序本身上安装 origin-pull-ca.pem 吗？

当我将发送给我的证书与 origin-pull-ca.pem 进行比较时，两者不相等：

• origin-pull-ca.pem：指纹：1F5BA8DCF83E6453DD75C47780906710901AD641（其他信息：CN=origin-pull.cloudflare.net、S=加利福尼亚、L=旧金山、OU=Origin Pull、O="CloudFlare, Inc."、C=我们）
• 从 Cloudflare 发送：指纹：A27996CBA564D24731BC76439C48920C1F7D4AA3（附加信息：OU=Origin Pull、O="Cloudflare, Inc."、L=旧金山、S=加利福尼亚、C=美国）

他们不应该是平等的吗？

请注意：我不是证书、SSL 等领域的专家。我想在这里学习:)

我在这里问的问题完全相同https://community.cloudflare.com/t/manual-authenticated-origin-pulls-verification/145614 https://community.cloudflare.com/t/manual-authenticated-origin-pulls-verification/145614。不知道为什么，但 A27996CBA564D24731BC76439C48920C1F7D4AA3 它是正确的。

编辑：用链更新

public class CloudflareClientCertificateMiddleware
{
    private static X509Certificate2 _cloudflareOriginPullCert;
    private readonly RequestDelegate _next;

    public CloudflareClientCertificateMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task Invoke(HttpContext context)
    {
        if (_cloudflareOriginPullCert == null)
            _cloudflareOriginPullCert = Helpers.CertificateHelper.GetCertificateInSpecifiedStore("origin-pull.cloudflare.net", StoreName.Root, StoreLocation.LocalMachine);

        bool isCloudflareCertificate = true;
        X509Certificate2 clientCertificate = context.Connection.ClientCertificate;

        using (X509Chain chain = new X509Chain())
        {
            chain.ChainPolicy.ExtraStore.Add(_cloudflareOriginPullCert);
            chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
            // https://stackoverflow.com/questions/6097671/how-to-verify-x509-cert-without-importing-root-cert (Azure)
            //chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllowUnknownCertificateAuthority;

            // https://stackoverflow.com/a/7332193
            if (clientCertificate == null || chain.Build(clientCertificate) == false)
                isCloudflareCertificate = false;
            // Make sure we have the same number of elements.
            if (isCloudflareCertificate && chain.ChainElements.Count != chain.ChainPolicy.ExtraStore.Count + 1)
                isCloudflareCertificate = false;

            // Make sure all the thumbprints of the CAs match up.
            // The first one should be 'primaryCert', leading up to the root CA.
            if (isCloudflareCertificate)
            {
                for (int i = 1; i < chain.ChainElements.Count; i++)
                {
                    if (chain.ChainElements[i].Certificate.Thumbprint != chain.ChainPolicy.ExtraStore[i - 1].Thumbprint)
                        isCloudflareCertificate = false;
                }
            }
        }

        if (isCloudflareCertificate)
            await _next.Invoke(context);
        else
            context.Response.StatusCode = StatusCodes.Status403Forbidden;
    }
}