当我使用 localhost 连接时，如果我使用 IP 它不会连接

Question

我在同一台计算机上运行服务器和客户端，以进行测试。如果在客户端我使用地址 localhost 它可以工作，但如果我使用计算机的 IP“192.16.1.33”它会失败。错误信息是这样的：

    D0725 20:25:53.870862 Grpc.Core.Internal.NativeExtension gRPC native library loaded successfully.
D0725 20:25:53.872652 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "grpclb"
D0725 20:25:53.872779 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "cds_experimental"
D0725 20:25:53.872871 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "eds_experimental"
D0725 20:25:53.872962 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "lrs_experimental"
D0725 20:25:53.873053 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "priority_experimental"
D0725 20:25:53.873118 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "weighted_target_experimental"
D0725 20:25:53.873181 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "xds_routing_experimental"
D0725 20:25:53.873249 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "pick_first"
D0725 20:25:53.873311 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "round_robin"
D0725 20:25:53.873377 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\resolver\dns\c_ares\dns_resolver_ares.cc:504: Using ares dns resolver
I0725 20:25:55.903532 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\subchannel.cc:1033: Connect failed: {"created":"@1595701555.902000000","description":"OS Error","file":"T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\lib\iomgr\tcp_client_windows.cc","file_line":105,"os_error":"Unable to retrieve error string","syscall":"ConnectEx","wsa_error":10061}
I0725 20:25:55.904211 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\subchannel.cc:970: Subchannel 0000016821801D70: Retry immediately
I0725 20:25:55.904411 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\subchannel.cc:997: Failed to connect to channel, retryin

好像频道已经创建了，因为是子频道0000016821801D70，但是由于某种原因无法得到服务器的响应。

服务器的代码是这样的：

const int miPort = 5001;

            var cacert = File.ReadAllText("Keys/ca.crt");
            var cert = File.ReadAllText("Keys/server.crt");
            var key = File.ReadAllText("Keys/server.key");

            var keypair = new KeyCertificatePair(cert, key);
            var sslCreds = new SslServerCredentials(new List<KeyCertificatePair>
                                {
                                    keypair
                                }, cacert, false);

            Server server = new Server()
            {
                Services = { Gestor.BindService(new GestorAplicacionesService()) },
                //Ports = { new ServerPort("0.0.0.0", miPort, sslCreds) },
                Ports = { new ServerPort("localhost", miPort, sslCreds) },
            };
            server.Start();
            Console.WriteLine("Started server on port " + miPort);
            server.ShutdownTask.Wait();

我的客户的代码是这样的：

var miCaCertificate = File.ReadAllText("Keys/ca.crt");
                var miClientCertificate = File.ReadAllText("Keys/client.crt");
                var miClientPrivateKey = File.ReadAllText("Keys/client.key");

            var keypair = new KeyCertificatePair(_clientCertificate, _clientPrivateKey);
            var sslCreds = new SslCredentials(_caCertificate, keypair);

            var channel = new Channel(_serviceAddress, _port, sslCreds);
            var client = new Gestor.GestorClient(channel);

            await client.MiSaludoAsync();

证书有效，因为使用 localhost 它有效，但这是我用来使用 OpenSSL 创建自签名证书的脚本：

# Generate valid CA
openssl genrsa -passout pass:1234 -des3 -out ca.key 4096
openssl req -passin pass:1234 -new -x509 -days 365 -key ca.key -out ca.crt -subj  "/C=SP/ST=Spain/L=Valdepenias/O=Test/OU=Test/CN=Root CA"

# Generate valid Server Key/Cert
openssl genrsa -passout pass:1234 -des3 -out server.key 4096
openssl req -passin pass:1234 -new -key server.key -out server.csr -subj  "/C=SP/ST=Spain/L=Valdepenias/O=Test/OU=Server/CN=localhost"
openssl x509 -req -passin pass:1234 -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

# Remove passphrase from the Server Key
openssl rsa -passin pass:1234 -in server.key -out server.key

# Generate valid Client Key/Cert
openssl genrsa -passout pass:1234 -des3 -out client.key 4096
openssl req -passin pass:1234 -new -key client.key -out client.csr -subj  "/C=SP/ST=Spain/L=Valdepenias/O=Test/OU=Client/CN=localhost"
openssl x509 -passin pass:1234 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt

# Remove passphrase from Client Key
openssl rsa -passin pass:1234 -in client.key -out client.key




pause

我已尝试使用 2 个服务器证书。一个我用作通用名称“localhost”，当我在同一台计算机上运行客户端时，它可以工作，但在我使用 IP 的客户端时它不起作用。

后来我尝试了另一个服务器证书，以IP为公用名，但我仍然无法连接到服务器。

我读到的是在证书服务器中

Answer 1

为 IP 创建证书与为名称创建证书有点不同。对于证书，您可以添加替代名称（这是您创建通配符或多域证书的方式）或 IP 地址列表。

如果[alt_names] 正确，请检查 OpenSSL 的配置。更多信息请参见https://medium.com/@antelle/how-to-generate-a-self-signed-ssl-certificate-for-an-ip-address-f0dd8dddf754

要确保您的证书是针对域名或 IP 地址的，请使用命令openssl x509 -in client.crt -text -noout，在此命令的输出中您将看到如下内容：

        X509v3 extensions:
            X509v3 Subject Alternative Name:
                IP Address:127.0.0.1

如果它以“DNS:”而不是“IP 地址”开头，那么您需要更新证书的创建。