当我使用localhost connect时，如果我使用IP，它不会连接

Question

为了测试，我在同一台计算机上运行服务器和客户端。如果我在客户端使用地址localhost，它可以工作，但如果我使用计算机的IP地址"192.16.1.33“，它将失败。错误消息如下：

    D0725 20:25:53.870862 Grpc.Core.Internal.NativeExtension gRPC native library loaded successfully.
D0725 20:25:53.872652 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "grpclb"
D0725 20:25:53.872779 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "cds_experimental"
D0725 20:25:53.872871 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "eds_experimental"
D0725 20:25:53.872962 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "lrs_experimental"
D0725 20:25:53.873053 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "priority_experimental"
D0725 20:25:53.873118 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "weighted_target_experimental"
D0725 20:25:53.873181 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "xds_routing_experimental"
D0725 20:25:53.873249 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "pick_first"
D0725 20:25:53.873311 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\lb_policy_registry.cc:39: registering LB policy factory for "round_robin"
D0725 20:25:53.873377 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\resolver\dns\c_ares\dns_resolver_ares.cc:504: Using ares dns resolver
I0725 20:25:55.903532 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\subchannel.cc:1033: Connect failed: {"created":"@1595701555.902000000","description":"OS Error","file":"T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\lib\iomgr\tcp_client_windows.cc","file_line":105,"os_error":"Unable to retrieve error string","syscall":"ConnectEx","wsa_error":10061}
I0725 20:25:55.904211 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\subchannel.cc:970: Subchannel 0000016821801D70: Retry immediately
I0725 20:25:55.904411 0 T:\src\github\grpc\workspace_csharp_ext_windows_x64\src\core\ext\filters\client_channel\subchannel.cc:997: Failed to connect to channel, retryin

看起来通道是创建的，因为它是子通道0000016821801D70，但是由于某种原因无法从服务器得到响应。

服务器的代码是：

const int miPort = 5001；

            var cacert = File.ReadAllText("Keys/ca.crt");
            var cert = File.ReadAllText("Keys/server.crt");
            var key = File.ReadAllText("Keys/server.key");

            var keypair = new KeyCertificatePair(cert, key);
            var sslCreds = new SslServerCredentials(new List<KeyCertificatePair>
                                {
                                    keypair
                                }, cacert, false);

            Server server = new Server()
            {
                Services = { Gestor.BindService(new GestorAplicacionesService()) },
                //Ports = { new ServerPort("0.0.0.0", miPort, sslCreds) },
                Ports = { new ServerPort("localhost", miPort, sslCreds) },
            };
            server.Start();
            Console.WriteLine("Started server on port " + miPort);
            server.ShutdownTask.Wait();

我的客户端代码是这样的：

var miCaCertificate = File.ReadAllText("Keys/ca.crt");
                var miClientCertificate = File.ReadAllText("Keys/client.crt");
                var miClientPrivateKey = File.ReadAllText("Keys/client.key");

            var keypair = new KeyCertificatePair(_clientCertificate, _clientPrivateKey);
            var sslCreds = new SslCredentials(_caCertificate, keypair);

            var channel = new Channel(_serviceAddress, _port, sslCreds);
            var client = new Gestor.GestorClient(channel);

            await client.MiSaludoAsync();

证书是有效的，因为对于本地主机，它是有效的，但这是我用来使用OpenSSL创建自签名证书的脚本：

# Generate valid CA
openssl genrsa -passout pass:1234 -des3 -out ca.key 4096
openssl req -passin pass:1234 -new -x509 -days 365 -key ca.key -out ca.crt -subj  "/C=SP/ST=Spain/L=Valdepenias/O=Test/OU=Test/CN=Root CA"

# Generate valid Server Key/Cert
openssl genrsa -passout pass:1234 -des3 -out server.key 4096
openssl req -passin pass:1234 -new -key server.key -out server.csr -subj  "/C=SP/ST=Spain/L=Valdepenias/O=Test/OU=Server/CN=localhost"
openssl x509 -req -passin pass:1234 -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

# Remove passphrase from the Server Key
openssl rsa -passin pass:1234 -in server.key -out server.key

# Generate valid Client Key/Cert
openssl genrsa -passout pass:1234 -des3 -out client.key 4096
openssl req -passin pass:1234 -new -key client.key -out client.csr -subj  "/C=SP/ST=Spain/L=Valdepenias/O=Test/OU=Client/CN=localhost"
openssl x509 -passin pass:1234 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt

# Remove passphrase from Client Key
openssl rsa -passin pass:1234 -in client.key -out client.key




pause

我已经尝试了2台服务器的证书。其中一个是我使用的通用名称"localhost"，当我在同一台计算机上运行客户端时，它可以工作，但当我在客户端使用IP时，它就不起作用了。

后来我尝试了另一个服务器证书，使用IP作为公用名，但我仍然无法连接到服务器。

我读到的是在证书服务器中

Answer 1

为IP创建证书与为名称创建证书略有不同。对于证书，您可以添加备用名称(这是创建通配符或多域证书的方式)或IP地址列表。

如果[alt_names]正确，请检查OpenSSL的配置。有关详细信息，请参阅https://medium.com/@antelle/how-to-generate-a-self-signed-ssl-certificate-for-an-ip-address-f0dd8dddf754

要确保您的证书是针对域名或ip地址的，请使用命令openssl x509 -in client.crt -text -noout，在此命令的输出中，您将看到以下内容：

        X509v3 extensions:
            X509v3 Subject Alternative Name:
                IP Address:127.0.0.1

如果它以'DNS:‘而不是'IP Address’开头，那么你需要更新证书的创建。