如何使用 Azure API 管理入站策略中的根 CA 证书验证我的客户端证书？
How to verify my client certificate with the Root CA certificate in Azure API Management inbound policy?
我必须从 Azure APIM 入站策略中的 Azure 密钥保管库获取我的根 CA，并在策略中验证我请求的客户端证书。
为此，我遵循了 link 并能够获得证书
https://github.com/galiniliev/api-management-policy-snippets/blob/galin/AkvCert/examples/Look%20up%20Key%20Vault%20certificate%20using%20Managed%20Service%20Identity%20and%20call%20backend.policy.xml
但是我无法使用从 Azure 密钥保管库获取的我的根 CA 来验证客户端证书
以下是我从 Azure 密钥保管库获取的根 CA 的值
{"id":"https://newdev-keyvault.vault.azure.net/certificates/MyRootCA/bf34888e**********","kid":"https://newdev-keyvault.vault.azure.net/keys/MyRootCA/bf34888e*************","sid":"https://newdev-keyvault.vault.azure.net/secrets/MyRootCA/bf34888**************","x5t":"gYbnPUooh4D5_ogrmWCEvfDjYXo","cer":"MIIDFTCCAf2gAwIBAgIUJYAgKiqYPh+Iq1DFULomUlhzNTAwDQYJKoZIhvcNAQELBQAwGjELMAkGA1UEBhMCSW4xCzAJBgNVBAoMAlwuMB4XDTIwMDQxNjA4MTgyOFoXDTMwMDQxNDA4MTgyOFowGjELMAkGA1UEBhMCSW4xCzAJBgNVBAoMAlwuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EOpy+GxPFCidiW5hGPVlPXuZFfgJdZWITLkUQ2SvcuBfLSsKmPkSpYO7TAFESpBWD0z8y3BYat0hGA2iBhMWzXN0dhbB+bZ6uDdrg0kuGaFmb4fmQ9mydM7cy3NtZA6lf5uTp9RZV4wiUVyKrRgGRzKUxecnFmtCOyk+jeW/Jf38laN1l84eM47UaMJjWD9vg/3QsW3yH+8zst2gWfXN7giQFRCMnzYTRD0VOd3N+C3k2mx72d4DobwbsngIclDHK0BFUckdK8MaOVIixRRQjFTZ/XjRqhPOCZRbgHHldXfx352eYqzOfYOi/utv8s6Xwl/0TI3uj2RTth7CwJkQIDAQABo1MwUTAdBgNVHQ4EFgQUZZMEGpRcswKq23a52gqebZcnloAwHwYDVR0jBBgwFoAUZZMEGpRcswKq23a52gqebZcnloAwDwYDVR0TAQH/BAUwAwEB","attributes":{"enabled":true,"nbf":1587025108,"exp":1902385108,"created":1587036499,"updated":1587036499, "recoveryLevel":"Recoverable+Purgeable"}}
谁能帮我验证入站策略中的客户端证书？
您从 AKV 动态获取的证书目前无法用于验证来自请求的客户端证书。唯一的方法是将 CA 证书上传到 APIM，然后调用 .Validate 请求证书。这将要求您从 AKV 导出证书并在每次更改时在 APIM 中刷新它。
我必须从 Azure APIM 入站策略中的 Azure 密钥保管库获取我的根 CA，并在策略中验证我请求的客户端证书。 为此，我遵循了 link 并能够获得证书 https://github.com/galiniliev/api-management-policy-snippets/blob/galin/AkvCert/examples/Look%20up%20Key%20Vault%20certificate%20using%20Managed%20Service%20Identity%20and%20call%20backend.policy.xml
但是我无法使用从 Azure 密钥保管库获取的我的根 CA 来验证客户端证书 以下是我从 Azure 密钥保管库获取的根 CA 的值 {"id":"https://newdev-keyvault.vault.azure.net/certificates/MyRootCA/bf34888e**********","kid":"https://newdev-keyvault.vault.azure.net/keys/MyRootCA/bf34888e*************","sid":"https://newdev-keyvault.vault.azure.net/secrets/MyRootCA/bf34888**************","x5t":"gYbnPUooh4D5_ogrmWCEvfDjYXo","cer":"MIIDFTCCAf2gAwIBAgIUJYAgKiqYPh+Iq1DFULomUlhzNTAwDQYJKoZIhvcNAQELBQAwGjELMAkGA1UEBhMCSW4xCzAJBgNVBAoMAlwuMB4XDTIwMDQxNjA4MTgyOFoXDTMwMDQxNDA4MTgyOFowGjELMAkGA1UEBhMCSW4xCzAJBgNVBAoMAlwuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs2EOpy+GxPFCidiW5hGPVlPXuZFfgJdZWITLkUQ2SvcuBfLSsKmPkSpYO7TAFESpBWD0z8y3BYat0hGA2iBhMWzXN0dhbB+bZ6uDdrg0kuGaFmb4fmQ9mydM7cy3NtZA6lf5uTp9RZV4wiUVyKrRgGRzKUxecnFmtCOyk+jeW/Jf38laN1l84eM47UaMJjWD9vg/3QsW3yH+8zst2gWfXN7giQFRCMnzYTRD0VOd3N+C3k2mx72d4DobwbsngIclDHK0BFUckdK8MaOVIixRRQjFTZ/XjRqhPOCZRbgHHldXfx352eYqzOfYOi/utv8s6Xwl/0TI3uj2RTth7CwJkQIDAQABo1MwUTAdBgNVHQ4EFgQUZZMEGpRcswKq23a52gqebZcnloAwHwYDVR0jBBgwFoAUZZMEGpRcswKq23a52gqebZcnloAwDwYDVR0TAQH/BAUwAwEB","attributes":{"enabled":true,"nbf":1587025108,"exp":1902385108,"created":1587036499,"updated":1587036499, "recoveryLevel":"Recoverable+Purgeable"}}
谁能帮我验证入站策略中的客户端证书？
您从 AKV 动态获取的证书目前无法用于验证来自请求的客户端证书。唯一的方法是将 CA 证书上传到 APIM，然后调用 .Validate 请求证书。这将要求您从 AKV 导出证书并在每次更改时在 APIM 中刷新它。