当前位置： 首页 > news >正文

【Azure APIM】APIM的自建网关如何解决自签名证书的受信任问题呢？(方案三)

news 2026/3/26 21:41:17

问题描述

在先前的四篇博文

1：【Azure APIM】APIM的自建网关如何解决自签名证书的受信任问题呢？(方案二) 

2：【Azure APIM】APIM的自建网关如何解决自签名证书的受信任问题呢？(方案一)  

3：【Azure APIM】如何解决后端API服务配置自签名证书时APIM请求报错500：Error occured while calling backend service 

4：【Azure 环境】在Windows环境中使用OpenSSL生成自签名证书链步骤分享

我们分别介绍了使用OpenSSL生成自签名证书，然后解决APIM服务对自签名证书的信任问题。不论是APIM托管的网关，还是自建的网关都可以通过安装证书后使得请求受信任，通过配置API跳过证书验证环节。

本文这从“自建网关本身AKS POD” 方面入手，通过配置 SSL_CERT_FILE 环境变量，来安装自签名证书 （根证书和中间证书）到POD中。

经过AI大模型解答，在 AKS (Azure Kubernetes Service) 中访问使用自签名证书的 API，关键在于让客户端信任该证书，主要的思路是：

  1. 创建包含 CA 证书的 Secret
  2. 将自签名的 CA 证书文件 (例如 ca.crt) 导入到 AKS 集群
  3. 在应用部署的 YAML 文件中，将该 Secret 挂载到容器内，并设置 SSL_CERT_FILE 环境变量指向该证书

image

操作步骤

第一步：准备好中间证书和根证书合并一起的 .crt 内容

导出方法：通过浏览器导出中间证书+根证书的 crt 文件，其内容是 Base64 编码

image

 

第二步：创建Kubernetes Secret

将自签名的 CA 证书文件 (例如 my-inetr-ca.crt) 导入到 AKS 集群中：

命令：

kubectl create secret generic self-signed-ca --from-file="<the full path of my-inetr-ca.crt>"

结果：

image

 

第三步：在APIM的自建网关Pod中挂载证书

在应用部署的 YAML 文件中，将该 Secret 挂载到容器内，并设置 SSL_CERT_FILE 环境变量指向该证书

...volumeMounts:- name: ca-volumemountPath: /etc/ssl/certs/my-ca.crtsubPath: my-inetr-ca.crtenv:- name: SSL_CERT_FILEvalue: /etc/ssl/certs/my-ca.crt... volumes:- name: ca-volumesecret:secretName: self-signed-ca...

把从APIM获取的部署yaml内容，只修改如图中的三个位置，即可。

image

第四步：部署以上配置，后访问AKS Service External URL进行测试验证

# 部署
kubectl apply -f "<apim self-hosted gateway yaml file>"
#获取对外暴露的IP地址
kubectl get services
 
##测试访问自建网关中的API
curl https://<external ip>/api -k 
测试结果，成功通过证书验证及获取正确的结果：

image

 

如果没有配置SSL_CERT_FILE 及挂载证书，就会遇见500 Internal server error。如果进一步通过 kubectl logs <pod name> 查看GatewayLogs日志，就会发现详细错误：The remote certificate was rejected by the provided RemoteCertificateValidationCallback.

详细错误

[Info] 2026-01-23T07:26:27.251 [DnsResolutionScheduled], message: xselfca02.myxxxxx.com, source: RoundRobinNameResolver
[Info] 2026-01-23T07:26:27.252 [OutgoingTlsProtocolsSet], message: Tls, Tls11, Tls12, source: TcpChannelFactory
[Info] 2026-01-23T07:26:27.598 [CertificateInfoVerificationScheduled], message: thumbprint: 62BF1CFA2116828E3F0B3C7D8FB4C380CD2CE358, subjectName: CN=*.myxxxxx.com, O=My Self Server Org, S=Chongqing, C=CN (CRL URLs: ; AIA URLs: )
[Warn] 2026-01-23T07:26:27.601 [FailedToProcessRequest], ActivityId: d5d383dc-c395-4111-8558-2193f9bbb8ff, correlationId: d5d383dc-c395-4111-8558-2193f9bbb8ff, apiId: 69303f7730caebcf2a534309, operationId: get-home-page, tags: 20, httpMethod: GET, source: request-forwarder, serviceName: apim-gateway, exception: System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback.
at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan`1 alert, ExceptionDispatchInfo exception)
at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
at Gateway.Http.Client.DotNetty.TcpChannelFactory.CreateChannelAsync(IPEndPoint endpoint, RequestedApplicationProtocol requestedApplicationProtocol, TlsInfo tlsMetadata, HttpProxy httpProxyMetadata, Int32 destinationPort, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\TcpChannelFactory.cs:line 116
at Gateway.Http.Client.DotNetty.EndpointPool.CreateAsyncInternal(IPipelineContext pipelineContext, ChannelPoolKey channelPoolKey, RequestedApplicationProtocol requestedApplicationProtocol, CancellationToken cancellationToken, GateInfo gateInfo) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\EndpointPool.cs:line 307
at Gateway.Http.Client.DotNetty.EndpointPool.CreateAsync(IPipelineContext pipelineContext, ChannelPoolKey channelPoolKey, RequestedApplicationProtocol requestedApplicationProtocol, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\EndpointPool.cs:line 128
at Gateway.Http.Client.DotNetty.SingleThreadedBackendChannelPool.AcquireAsync(IPipelineContext context, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\SingleThreadedBackendChannelPool.cs:line 189
at Gateway.Http.Client.DotNetty.RoundRobinBackendChannelPool.Acquire0(Object state) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\RoundRobinBackendChannelPool.cs:line 73
at Gateway.Http.Client.DotNetty.DotNettyHttpBackend.AcquireChannelAsync(IPipelineContext ctx, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\DotNettyHttpBackend.cs:line 791
at Gateway.Http.Client.DotNetty.DotNettyHttpBackend.ProcessAsync(IPipelineContext context, CancellationToken cancellation) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\DotNettyHttpBackend.cs:line 172
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.Policies.PipelineWalker.ExecuteAsync(IPipelineContext context, IEnumerable`1 steps, CancellationToken cancellation) in C:\__w\1\s\Proxy\Gateway.Pipeline\PipelineWalker.cs:line 66
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.ChildPipeline.ExecuteAsync(IPipelineContext context, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Pipeline\ChildPipeline.cs:line 35
at Gateway.Pipeline.Extensions.ValueTaskExtensions.Await[T](ValueTask`1 input) in C:\__w\1\s\Proxy\Gateway.Pipeline\Extensions\ValueTaskExtensions.cs:line 28
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.Policies.IO.CallServiceHandler.ProcessAsync(IPipelineContext context, CancellationToken cancellation) in C:\__w\1\s\Proxy\Gateway.Policies.General\IO\CallServiceHandler.cs:line 94
at Gateway.Http.Client.DotNetty.SingleThreadedBackendChannelPool.AcquireAsync(IPipelineContext context, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\SingleThreadedBackendChannelPool.cs:line 189
at Gateway.Http.Client.DotNetty.RoundRobinBackendChannelPool.Acquire0(Object state) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\RoundRobinBackendChannelPool.cs:line 73
at Gateway.Http.Client.DotNetty.DotNettyHttpBackend.AcquireChannelAsync(IPipelineContext ctx, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\DotNettyHttpBackend.cs:line 791
at Gateway.Http.Client.DotNetty.DotNettyHttpBackend.ProcessAsync(IPipelineContext context, CancellationToken cancellation) in C:\__w\1\s\Proxy\Gateway.Http.Client.DotNetty\DotNettyHttpBackend.cs:line 172
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.Policies.PipelineWalker.ExecuteAsync(IPipelineContext context, IEnumerable`1 steps, CancellationToken cancellation) in C:\__w\1\s\Proxy\Gateway.Pipeline\PipelineWalker.cs:line 66
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.ChildPipeline.ExecuteAsync(IPipelineContext context, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Pipeline\ChildPipeline.cs:line 35
at Gateway.Pipeline.Extensions.ValueTaskExtensions.Await[T](ValueTask`1 input) in C:\__w\1\s\Proxy\Gateway.Pipeline\Extensions\ValueTaskExtensions.cs:line 28
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.Policies.IO.CallServiceHandler.ProcessAsync(IPipelineContext context, CancellationToken cancellation) in C:\__w\1\s\Proxy\Gateway.Policies.General\IO\CallServiceHandler.cs:line 94
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.Policies.PipelineWalker.ExecuteAsync(IPipelineContext context, IEnumerable`1 steps, CancellationToken cancellation) in C:\__w\1\s\Proxy\Gateway.Pipeline\PipelineWalker.cs:line 66
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.ChildPipeline.ExecuteAsync(IPipelineContext context, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Pipeline\ChildPipeline.cs:line 35
at Gateway.Pipeline.Extensions.ValueTaskExtensions.Await[T](ValueTask`1 input) in C:\__w\1\s\Proxy\Gateway.Pipeline\Extensions\ValueTaskExtensions.cs:line 28
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.Policies.PipelineWalker.ExecuteAsync(IPipelineContext context, IEnumerable`1 steps, CancellationToken cancellation) in C:\__w\1\s\Proxy\Gateway.Pipeline\PipelineWalker.cs:line 66
at Microsoft.WindowsAzure.ApiManagement.Proxy.Gateway.PipelineExecutor.ExecuteAsync(IPipelineContext context, CancellationToken cancellationToken) in C:\__w\1\s\Proxy\Gateway.Pipeline\PipelineExecutor.cs:line 215, transportError: 0, httpError: 0
[Info] 2026-01-23T07:26:26.678 [GatewayLogs], correlationId: x-x-x-x, isRequestSuccess: false, totalTime: 922, category: "GatewayLogs", callerIpAddress: "x.x.x.x", timeGenerated: 2026-01-23T07:26:26.678, region: "aks", correlationId: "x-x-x-x-x", method: "GET", url: "https://x.x.x.x/xselfca", responseCode: 500, responseSize: 259, cache: "none", backendTime: 920, apiId: "XXXXXXXXXXXXXXXXXXX", operationId: "get-home-page", clientProtocol: "HTTP/1.1", apiRevision: "1", clientTlsVersion: "1.3", backendMethod: "GET", backendUrl: "https://xxx.xxx.com/", lastError: {"elapsed":921,"source":"request-forwarder","path":"forward-request\\forward-request","reason":"BackendConnectionFailure","message":"The remote certificate was rejected by the provided RemoteCertificateValidationCallback.","section":"backend"}, errors: [{"elapsed":921,"source":"request-forwarder","path":"forward-request\\forward-request","reason":"BackendConnectionFailure","message":"The remote certificate was rejected by the provided RemoteCertificateValidationCallback.","section":"backend"}]
[Info] 2026-01-23T07:27:22.895 [InitialDnsNeighborDiscoverySucceeded], message: Successfully resolved IP addresses for DNS name xnewcstest-instance-discovery: 10.244.1.11, source: Neighborhood

 

参考资料

Use custom certificate authorities (CAs) in Azure Kubernetes Service (AKS) : https://learn.microsoft.com/en-us/azure/aks/custom-certificate-authority

 

http://www.jsqmd.com/news/290012/

相关文章：

  • AI大模型微调指南：告别“炼丹”玄学，用数据与科学打造专属模型
  • 安全加固相关内容
  • 2026年优质建筑材料检测服务商推荐与机构选择指南
  • Product Hunt 每日热榜 | 2026-01-23
  • FPGA教程系列-Vivado Aurora 8B／10B IP核接口解析 - 实践
  • TB132FU原厂刷机包免费下载_CN_ZUI_16
  • 2026年磁铁厂家推荐排行榜：铁氧体/钕铁硼/无线充/耐高温/单面/瓦形/沉头孔/方形/圆形/异形/圆环磁铁，源头实力与创新应用深度解析
  • 如何进行员工绩效评估
  • 区块链去中心化存储的Prompt工程：提示工程架构师的数据管理
  • Ubuntu 上搜狗输入法突然“消失 / 只能英文”的排查与修复教程
  • 亲测好用10个AI论文平台，助你轻松搞定本科生毕业论文！
  • 2026研究生必备10个降AI率工具
  • 深入解析：【要闻周报】网络安全与数据合规 11-21
  • 2026年 印刷机厂家推荐排行榜：丝网印刷机/线路板印刷机/全自动印刷机/CCD全自动印刷机/亚克力印刷机/大尺寸印刷机，高精度与高效能智造之选
  • Spark机器学习库MLlib：大数据AI应用开发指南
  • 深度测评自考必备AI论文平台TOP10
  • 收藏！不降级也能用：LangChain 1.0+替代doctran实现问答转换，附完整代码详解
  • 【收藏必备】AI大模型工程架构深度指南：Skill、Agent与Workflow实战干货，建议反复研读
  • 收藏！工业级RAG系统与Agent应用开发实战：从ChatBot到AI架构师的蜕变之路，助你跨越从演示到生产的鸿沟
  • 深入解析：事务隔离级别终极指南：从脏读到串行化的并发控制艺术
  • 2026年最佳二次元测量仪工厂TOP5推荐，遇见高效精准测量解决方案
  • 2026年 自动缓存机/玻璃缓存机厂家推荐排行榜：高效智能与稳定耐用，工业自动化缓存设备优选指南
  • 2026年 丝印机厂家推荐排行榜，盖板丝印机，膜材丝印机，转盘式中尺寸丝印机，高精度稳定印刷设备精选
  • 智能体的上下文记忆优化方案
  • 【必看收藏】RAG三大形态深度解析：从传统检索到智能思考，AI不再瞎编乱造！
  • AI客服必看！有赞从0到1实践：模型选择、工作流设计、知识构建全指南（强烈推荐收藏）
  • 一文掌握多模态RAG：从理论到实践，收藏这篇就够了！
  • 收藏！LangGraph革命性突破：从链式到代理思维，彻底改变LLM应用开发范式
  • Linux 文件描述符、端口、进程与线程数量上限分析
  • 必看！2026年重庆全屋定制木质家具品牌推荐榜单