.net core 2.1 linux系统上任何操作都会报远程证书验证错误

做任何leancloud相关的读写操作都会报如下错误:

 {"ErrorMessage":"The remote certificate is invalid according to the validation procedure.","ErrorType":"System.Security.Authentication.AuthenticationException","StackTrace":["   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)","   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)","   at System.Net.Security.SslState.PartialFrameCallback(AsyncProtocolRequest asyncRequest)","--- End of stack trace from previous location where exception was thrown ---","   at System.Net.Security.SslState.ThrowIfExceptional()","   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)","   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)","   at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)","   at System.Net.Security.SslStream.<>c.<AuthenticateAsClientAsync>b__47_1(IAsyncResult iar)","   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)","--- End of stack trace from previous location where exception was thrown ---","   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)"]}

新老版本sdk都是这个错误,似乎是服务器证书问题?昨晚10点之后出现的。

安卓 sdk 同样出现证书问题

cn.leancloud.AVException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Caused by: cn.leancloud.AVException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at cn.leancloud.utils.ErrorUtils.propagateException(ErrorUtils.java:42)
at cn.leancloud.core.StorageClient$1.apply(StorageClient.java:66)
at cn.leancloud.core.StorageClient$1.apply(StorageClient.java:63)
at io.reactivex.internal.operators.observable.ObservableOnErrorNext$OnErrorNextObserver.onError(ObservableOnErrorNext.java:91)
at retrofit2.adapter.rxjava2.BodyObservable$BodyObserver.onError(BodyObservable.java:72)
at retrofit2.adapter.rxjava2.CallExecuteObservable.subscribeActual(CallExecuteObservable.java:59)
at io.reactivex.Observable.subscribe(Observable.java:12284)
at retrofit2.adapter.rxjava2.BodyObservable.subscribeActual(BodyObservable.java:34)
at io.reactivex.Observable.subscribe(Observable.java:12284)
at io.reactivex.internal.operators.observable.ObservableOnErrorNext.subscribeActual(ObservableOnErrorNext.java:38)
at io.reactivex.Observable.subscribe(Observable.java:12284)
at io.reactivex.internal.operators.observable.ObservableMap.subscribeActual(ObservableMap.java:32)
at io.reactivex.Observable.subscribe(Observable.java:12284)
at io.reactivex.internal.operators.observable.ObservableSingleMaybe.subscribeActual(ObservableSingleMaybe.java:31)
at io.reactivex.Maybe.subscribe(Maybe.java:4290)
at io.reactivex.Maybe.blockingGet(Maybe.java:2320)
... 82 common frames omitted

请提供一下出错对应的域名。

请问 Android 系统的版本是多少?

确认是这个域名吗?我们刚刚检查了,这个域名下的证书链中的证书均没有过期。

我们确认了一下:
这个故障与设备中的根证书有关,需要升级设备上的根证书。

原由是:
这个域名现有证书链中的 root ca: ISRG Root X1 ,在某上旧设备上没有被信任,所以会报证书异常。

奇怪的地方是:为何之前却可以用呢?这是因为 letsencrypt 为了兼容旧的设备,引入了另一个 root ca: DST Root CA X3,这样旧的设备就能正常访问了。现在这个 X3 CA 在 2021/09/30 过期了,因此这些旧设备无法再正常请求了。

参考官方 https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

请问下这要要怎么解决?,是将服务端证书更新吗?