.NET 反向代理-YARP 部署Https（SSL）

合集 - .NET(21)

1..NET Core 环境搭建2022-03-162..Net Core IOC DI（依赖注入）2022-03-163..NET Core 读取配置技巧 - IOptions 接口2022-05-254..Net Core 依赖注入（IOC） 一些简单的使用技巧2022-05-065..Net Core 可为Null的类型2022-04-026..Net Core 配置文件 appsettings.json2022-03-25

7..NET 反向代理-YARP 部署Https（SSL）2022-09-21

8..NET 反向代理-YARP 根据域名转发2022-09-219..NET 7 来了！！！2022-09-1910..NET 反向代理-YARP2022-09-0711..Net Core 配置文件读取 - IOptions、IOptionsMonitor、IOptionsSnapshot2022-09-0212..NET Core 实现后台任务（定时任务）Longbow.Tasks 组件（三）2022-07-2313..NET Core 实现后台任务（定时任务）BackgroundService（二）2022-07-1314..NET Core 实现后台任务（定时任务）IHostedService（一）2022-07-0815..Net WebApi 中的 FromBody FromForm FromQuery FromHeader FromRoute2022-10-0716..NET 反向代理 YARP 代理 GRPC2022-09-2817..Net 7 C#11 原始字符串2022-09-2618..NET 反向代理 YARP 跨域请求 CORS2022-09-2619..NET 反向代理 YARP 自定义配置提供程序（Configuration Providers）2022-09-2520..NET 反向代理 YARP 通过编码方式配置域名转发2022-09-2421..NET 部署 多域名 Https（SSL）通过代码方式2022-09-23

收起

　　YARP 作为反向代理中间件，那就无可避免需要使用到 Https 去部署项目，那 YARP 要怎么去实现呢，本来以为 YARP 会有一套自己的实现，在翻阅了资料后发现，根本不是我想的那样，按照 YARP 官方文档的说法，是按照 .Net Core 原本的那一套去实现，好家伙，真的没想到啊，下面我贴出官方原文，大伙看一看，瞧一瞧

　　IIS就不多说了，这个毕竟只能在 windows 上使用，下面我说说 在 Kestrel 怎么设置 Https 吧，按照我的惯例，直接贴配置文件

"Kestrel": {
  "Endpoints": {
    "MySniEndpoint": {
      "Url": "https://*:5209",
      "SslProtocols": [ "Tls11", "Tls12" ],
      "Sni": {
        "test1.ysmc.net.cn": {
          "Certificate": {
            "Path": "[path]\\test1.ysmc.net.cn_server.pfx",
            "Password": "pfx密码"
          }
        },
        "test2.ysmc.net.cn": {
          "Certificate": {
            "Path": "[path]\\test2.ysmc.net.cn_server.pfx",
            "Password": "pfx密码"
          }
        }
      }
    }
  },
  //，默认配置，当没有配置的时候，默认回落到这个配置   
  "Certificates": {
    "Default": {
      "Path": "[path]\\test1.ysmc.net.cn_server.pfx",
      "Password": "pfx密码"
    }
  }

　　因为我们需要配置多个域名，所以使用到了 Sni，下面是官方对一 Sni 的部分介绍，感兴趣的小伙伴可以过去看看，传送门

---

 

SNI in configuration

Kestrel supports SNI defined in configuration. An endpoint can be configured with an object that contains a mapping between host names and HTTPS options. The connection host name is matched to the options and they are used for that connection.Sni

The following configuration adds an endpoint named that uses SNI to select HTTPS options based on the host name:MySniEndpoint

HTTPS options that can be overridden by SNI:

• Certificate configures the certificate source.
• Protocols configures the allowed HTTP protocols.
• SslProtocols configures the allowed SSL protocols.
• ClientCertificateMode configures the client certificate requirements.

The host name supports wildcard matching:

• Exact match. For example, matches .a.example.orga.example.org
• Wildcard prefix. If there are multiple wildcard matches then the longest pattern is chosen. For example, matches and .*.example.orgb.example.orgc.example.org
• Full wildcard. matches everything else, including clients that aren't using SNI and don't send a host name.*

The matched SNI configuration is applied to the endpoint for the connection, overriding values on the endpoint. If a connection doesn't match a configured SNI host name then the connection is refused.

---

 

下面一起看看配置后的效果吧，非常的完美

 

 　　整个完整的配置文件我也贴出来吧，至于证书怎么申请的，大家有域名的可以到域名服务商里申请免费1年期的，没有域名的话，可以自己改一下hosts 文件 然后自己自签名一个，都是可以的

appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "Kestrel": {
    "Endpoints": {
      "MySniEndpoint": {
        "Url": "https://*:5209",
        "SslProtocols": [ "Tls11", "Tls12" ],
        "Sni": {
          "test1.ysmc.net.cn": {
            "Certificate": {
              "Path": "[path]\\test1.ysmc.net.cn_server.pfx",
              "Password": "pfx密码"
            }
          },
          "test2.ysmc.net.cn": {
            "Certificate": {
              "Path": "[path]\\test2.ysmc.net.cn_server.pfx",
              "Password": "pfx密码"
            }
          }
        }
      }
    },
    "Certificates": {
      "Default": {
        "Path": "[path]\\test1.ysmc.net.cn_server.pfx",
        "Password": "pfx密码"
      }
    }
  },
  "ReverseProxy": {
    "Routes": {
      "baidu": {
        "ClusterId": "baidu",
        "Match": {
          "Hosts": [ "test1.ysmc.net.cn" ],
          "Path": "{**catch-all}"
        }
      },
      "blazor": {
        "ClusterId": "blazor",
        "Match": {
          "Hosts": [ "test2.ysmc.net.cn" ],
          "Path": "{**catch-all}"
        }
      }
    },
    "Clusters": {
      "baidu": {
        "LoadBalancingPolicy": "RoundRobin",
        "Destinations": {
          "baidu": {
            "Address": "https://www.baidu.com/"
          }
        }
      },
      "blazor": {
        "LoadBalancingPolicy": "RoundRobin",
        "Destinations": {
          "blazor": {
            "Address": "https://www.blazor.zone/"
          }
        }
      }
    }
  }
}

 原文链接：https://www.cnblogs.com/ysmc/p/16717580.html