Как сделать докеризованный сертификат ASP.net Core 9 Web API Trust. ⇐ C#

[Anonymous]

У меня есть два веб -API, работающие в Docker:

[*] Identity API (OpenIddict Server) - проблемы JWT Tokens
Voucher API (защищенный ресурс) - подтверждает JWT Tokens с использованием addJwtbearer

Конфигурация API идентификации
В моей программе.opt.AddSigningCertificate(new X509Certificate2(signingCertPath, signingCertPassword));
opt.AddEncryptionCertificate(new X509Certificate2(encryptionCertPath, encryptionCertPassword));
< /code>
Я также генерирую саморегистрированный сертификат HTTPS локально с Sans < /p>
using (var httpsAlgorithm = RSA.Create(keySizeInBits: 2048))
{
var httpsSubject = new X500DistinguishedName("CN=localhost, O=Local Development, C=US");
var httpsRequest = new CertificateRequest(httpsSubject, httpsAlgorithm, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);

// Key usage for HTTPS
httpsRequest.CertificateExtensions.Add(new X509KeyUsageExtension(
X509KeyUsageFlags.DigitalSignature | X509KeyUsageFlags.KeyEncipherment, critical: true));

// Enhanced key usage for server authentication
httpsRequest.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(
new OidCollection { new Oid("1.3.6.1.5.5.7.3.1") }, // Server Authentication
critical: true));

// Subject Alternative Names
var sanBuilder = new SubjectAlternativeNameBuilder();
sanBuilder.AddDnsName("localhost");
sanBuilder.AddDnsName("127.0.0.1");
sanBuilder.AddDnsName("identity-api"); // Docker service name
sanBuilder.AddIpAddress(System.Net.IPAddress.Loopback);
sanBuilder.AddIpAddress(System.Net.IPAddress.Parse("127.0.0.1"));
httpsRequest.CertificateExtensions.Add(sanBuilder.Build());

var httpsCertificate = httpsRequest.CreateSelfSigned(validFrom, validTo);

string httpsPassword = "testpassword!";
File.WriteAllBytes("https-certs/https-cert.pfx", httpsCertificate.Export(X509ContentType.Pfx, httpsPassword));
}

api api dockerfile (соответствующие части):
FROM mcr.microsoft.com/dotnet/aspnet:9.0-bookworm-slim AS base
USER root
WORKDIR /app
EXPOSE 8080
EXPOSE 8081

# Copy HTTPS certificates
# (mounted via docker-compose)
RUN mkdir -p /app/https-certs && chmod 700 /app/https-certs

FROM build AS final
WORKDIR /app
COPY --from=publish /app/publish .

ENTRYPOINT ["dotnet", "Rock.Identity.API.dll"]
< /code>
docker-compose.yml (соответствующие части):
services:
identity-api:
build:
context: .
dockerfile: Dockerfile
ports:
- "3400:8080"
- "3401:8081"
environment:
- DOTNET_ENVIRONMENT=Production
- ASPNETCORE_URLS=http://+:8080;https://+:8081
- ASPNETCORE_Kestrel__Certificates__Default__Path=/app/https-certs/https-cert.pfx
- ASPNETCORE_Kestrel__Certificates__Default__Password=testpassword!
volumes:
- ./https-certs:/app/https-certs:ro
networks:
- identity-network
< /code>
Initial issue (when running Voucher API in Visual Studio)
At first, when I ran the Identity API in Docker and Voucher API locally in Visual Studio, I got this error:

IDX10500: Signature validation failed. No security keys were provided to validate the signature.
at Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateSignature(JsonWebToken jwtToken, TokenValidationParameters validationParameters, BaseConfiguration configuration)

at Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateSignatureAndIssuerSecurityKey(JsonWebToken jsonWebToken, TokenValidationParameters validationParameters, BaseConfiguration configuration)

at Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.ValidateJWSAsync(JsonWebToken jsonWebToken, TokenValidationParameters validationParameters, BaseConfiguration configuration)

To resolve I installed the self-signed certificate called https-cert.pfx (который я использовал в API Identity) в магазине сертификатов моей локальной машины. и все сработало.
текущая проблема (когда оба API работают в докере) чASTI):
FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS base
WORKDIR /app
EXPOSE 8080
EXPOSE 8081

FROM mcr.microsoft.com/dotnet/sdk:9.0 AS build
ARG BUILD_CONFIGURATION=Release
COPY ["src/Api/Renault.Voucher.API/Renault.Voucher.API.csproj", "src/Api/Renault.Voucher.API/"]
# (other projects copied here)
RUN dotnet restore "./src/Api/Renault.Voucher.API/Renault.Voucher.API.csproj"
COPY . .
WORKDIR "/src/Api/Renault.Voucher.API"
RUN dotnet build "./Renault.Voucher.API.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./Renault.Voucher.API.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "Renault.Voucher.API.dll"]
< /code>
Do I need to install the same self-signed certificate inside the Voucher API Docker container? If yes how can I do it?
Updated:
here what https://localhost:3401/.well-known/jwks returns
{
"keys": [
{
"kid": "1A6234F28AD994AE533BC9C5DCA7FCCAA1C3306A",
"use": "sig",
"kty": "RSA",
"alg": "RS256",
"e": "AQAB",
"n": "wl6grdDEbk7jFQdLf4T9oi5zKwlsQfyqF7ieLd9iTyi3_yLEgU8rKJGO8JSCAtB8nrYSAhePEUmMsusneQ9AOs7JTlIROjgOak1W548qIfxCx2Q-2P1ixM9q9zsZbyby7ZOOBZoNiP9Gbj74dtwo8AhGaXAM2r3o3_vIs6v7uoTGCqZ9YAsG9kd_PWWv_VDc0RzAf1U4-4pdzqpnXTITDOvXaRaa_xJgE-APo_2OUEHfY0z5QPlEFWv4ALp4UmV-wVW6QCJ2bfEQfaiBto-tW2SXlfjcUpx9BuCExRq3etyNOoB1G9P5GFBYhfBJgCWmMNmsPjAogGeIUr5QMoGtAQ",
"x5t": "GmI08orZlK5TO8nF3Kf8yqHDMGo",
"x5c": [
"MIIDQzCCAiugAwIBAgIJAL6lcVVIkWxIMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxSb2NrIFN5c3RlbXMxMTAvBgNVBAMTKFJvY2sgSWRlbnRpdHkgU2VydmVyIFNpZ25pbmcgQ2VydGlmaWNhdGUwHhcNMjUwODI1MDk1NDA0WhcNMjcwODI1MDk1NDA0WjBXMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMUm9jayBTeXN0ZW1zMTEwLwYDVQQDEyhSb2NrIElkZW50aXR5IFNlcnZlciBTaWduaW5nIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwl6grdDEbk7jFQdLf4T9oi5zKwlsQfyqF7ieLd9iTyi3/yLEgU8rKJGO8JSCAtB8nrYSAhePEUmMsusneQ9AOs7JTlIROjgOak1W548qIfxCx2Q+2P1ixM9q9zsZbyby7ZOOBZoNiP9Gbj74dtwo8AhGaXAM2r3o3/vIs6v7uoTGCqZ9YAsG9kd/PWWv/VDc0RzAf1U4+4pdzqpnXTITDOvXaRaa/xJgE+APo/2OUEHfY0z5QPlEFWv4ALp4UmV+wVW6QCJ2bfEQfaiBto+tW2SXlfjcUpx9BuCExRq3etyNOoB1G9P5GFBYhfBJgCWmMNmsPjAogGeIUr5QMoGtAQIDAQABoxIwEDAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggEBACR0nT1kU6tey21S4XhnBs4o6pMzeIxso11lVKmzUtOCmSMpXVxifH0HfYTFKajOfLaybrwyWliM7u+Bn9bmTQWAa9DCMcL/tzZFHhoBNRO4/HQo8p4Fa4OFIMF/BJd4w0cfz6p0+FmN04/CCW1vM8XvSrRG3HOSaOKeXrdYlRgjd9TtqH+o6JCuqFrE2EoNpWJRUyo53f3nV2/NULmA8v5xvXc6L3SEdSbIf5P+RcRvHTc5s3AMBYtVDBvxD1x4ShK5Pu8pLXPOFK3M51rMvlBTr9D4GQf55Qgrfhla4vEHuC/tQuVMu6R+cnDVI7XuBkbjfh71kcEOXurSmcycJQE="
]
}
]
}
< /code>
and here what https://localhost:3401/.well-known/openid-configuration returns
{
"issuer": "https://localhost:3401/",
"token_endpoint": "https://localhost:3401/connect/token",
"jwks_uri": "https://localhost:3401/.well-known/jwks",
"grant_types_supported": [
"client_credentials",
"refresh_token",
"password"
],
"scopes_supported": [
"openid",
"offline_access"
],
"claims_supported": [
"aud",
"exp",
"iat",
"iss",
"sub"
],
"id_token_signing_alg_values_supported": [
"RS256"
],
"subject_types_supported": [
"public"
],
"prompt_values_supported": [
"consent",
"login",
"none",
"select_account"
],
"token_endpoint_auth_methods_supported": [
"client_secret_post",
"private_key_jwt",
"client_secret_basic"
],
"require_pushed_authorization_requests": false,
"claims_parameter_supported": false,
"request_parameter_supported": false,
"request_uri_parameter_supported": false,
"tls_client_certificate_bound_access_tokens": false,
"authorization_response_iss_parameter_supported": true
}
< /code>
Sample JWT token:
eyJhbGciOiJSUzI1NiIsImtpZCI6IjFBNjIzNEYyOEFEOTk0QUU1MzNCQzlDNURDQTdGQ0NBQTFDMzMwNkEiLCJ4NXQiOiJHbUkwOG9yWmxLNVRPOG5GM0tmOHlxSERNR28iLCJ0eXAiOiJhdCtqd3QifQ.eyJpc3MiOiJodHRwczovL2xvY2FsaG9zdDozNDAxLyIsImV4cCI6MTc1NjM4MDY0MSwiaWF0IjoxNzU2Mzc3MDQxLCJqdGkiOiI3M2UyMDg2Yy04MWRkLTQyYzAtYjA3OC1kMmEwYWQ5OGE4M2EiLCJzdWIiOiIyNmMwMzQyNi1lOTY4LTQzM2MtOGZiMS0yYzA4ODEwNGQyMDIiLCJhdWQiOiJSZXNvdXJzZSIsIm9pX3Rrbl9pZCI6ImY2NGI5YzI0LTZlMmYtNDAzMi1iYTgzLThiM2VhYzRkNjQ5MyJ9.lioM3WG6lr5K2nF7G84GVg0N8lkfIvIkgiRF-JHkVpv06T5znqikjAKV0b4ojZE3bfNN8jodnDP3iPyqdMFigYPuy7txJG3zGP48ayZszWryfHTi0YiG2_MDv0psOh4zT4lWUCZgxWt0RXCjROs4ombMw2dT4DW6kKCC7Uzda_2evWJ9fxbtv4ulN5ffV02TQvdVbWsNDgAQuSzb78fKafhd92jOrA5qoBdeHHJZ-bam7JFvKPQlw6D1eFYQa_uvx35-F64gD0v7FxhLbYd3r0EVX3mLXL-S1EEGAAnW7V61keU_9UgMThjF1S8RbMXeVK3Avcq24u6XImdSZhi4Cg


Подробнее здесь: https://stackoverflow.com/questions/797 ... g-certific