我实现了一个dotnet核心API，其中端点是基于Controller属性Route定义的。
我想配置IIS，以便忽略controller 1的客户端证书，而controller 2需要客户端证书。在我的API中，我这样实现了主机

public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .UseStartup<Startup>()
            .ConfigureKestrel(o =>
            {
                o.ConfigureHttpsDefaults(o=>o.ClientCertificateMode=ClientCertificateMode.AllowCertificate);
            })
            .UseIISIntegration()
            .ConfigureLogging(logging =>
            {
                logging.ClearProviders();
                logging.SetMinimumLevel(LogLevel.Debug);
            })
            .UseNLog();

和配置的服务

services.AddSingleton<CertificateValidationService>();

    services.Configure<IISOptions>(options =>
    {
        options.ForwardClientCertificate = true;
    });
    services.AddAuthentication()
        .AddCertificate(x =>
        {
            x.AllowedCertificateTypes = CertificateTypes.All;
            x.ValidateValidityPeriod = true;
            x.RevocationMode = X509RevocationMode.NoCheck;
            x.Events = new CertificateAuthenticationEvents
            {
                OnCertificateValidated = context =>
                {
                    _logger.Trace("Enters OnCertificateValidated");
                    var validationService =
                        context.HttpContext.RequestServices.GetService<CertificateValidationService>();
                    if (validationService.ValidateCertificate(context.ClientCertificate))
                    {
                        _logger.Trace("OnCertificateValidated success");
                        context.Success();
                    }
                    else
                    {
                        _logger.Trace("OnCertificateValidated fail");
                        context.Fail("invalid certificate");
                    }

                    return Task.CompletedTask;
                },
                OnAuthenticationFailed = context =>
                {
                    _logger.Trace("Enters OnAuthenticationFailed");
                    context.Fail("invalid certificate");
                    return Task.CompletedTask;
                }
            };
        });

下面是Startup.cs的Configure方法中的中间件管道配置

if (env.IsLocal())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler(appBuilder =>
            {
                appBuilder.Use(async (context, next) =>
                {
                    var error = context.Features[typeof(IExceptionHandlerFeature)] as IExceptionHandlerFeature;
                    if (error != null && error.Error is SecurityTokenExpiredException)
                    {
                        _logger.Warn($"No valid token provided. {error.Error.Message}");
                        context.Response.StatusCode = 401;
                        context.Response.ContentType = "application/json";
                        await context.Response.WriteAsync(JsonConvert.SerializeObject(new
                        {
                            IpUrl = _globalSettings.IdP.Url,
                            SpName = _globalSettings.IdP.Name,
                            Authenticate = context.Request.GetEncodedUrl(),
                            //State = 401,
                            Msg = "Token expired"
                        }));
                    }
                    else if (error?.Error != null)
                    {
                        _logger.Error($"Unexpected error - {error.Error.Message}");
                        context.Response.StatusCode = 500;
                        context.Response.ContentType = "application/json";
                        await context.Response.WriteAsync(JsonConvert.SerializeObject(new
                        {
                            State = 500,
                            Msg = error.Error.Message
                        }));
                    }
                    else
                    {
                        await next();
                    }
                });
            });
            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
            app.UseHsts();
        }
        app.UseHttpsRedirection();
        app.UseRouting();

        app.UseCors("AllowOrigin");
        app.UseAuthentication();
        app.UseAuthorization();

        app.UseSwagger(SwaggerHelper.ConfigureSwagger);
        app.UseSwaggerUI(SwaggerHelper.ConfigureSwaggerUi);

        app.UseEndpoints(endpoints => endpoints.MapControllers());

我尝试使用web.config位置，但“路径”API/controller 2实际上并不存在（它被路由了），因此没有效果
我在app文件夹中创建了faked API/controller 2文件夹来设置SSL要求。不幸的是，我得到了一个405，因为我丢失了路由，这些文件夹后面什么都没有。
我目前唯一的方法是在API应用程序级别“接受”证书，但是，我的前端在第一次查询时，我的API会在仅使用api/controller 1时请求证书
是否有办法或必须构建和部署特定的API来保护它，而另一个API不使用客户端证书？