HttpListener on Linux returns disposed client certificate

[martin-frydl]

When I create HttpListener for SSL on Linux and send client certificate to it, HttpListenerRequest.GetClientCertificate() returns disposed object and so invocation of any of the methods throws exception:

System.Security.Cryptography.CryptographicException: m_safeCertContext is an invalid handle.
at System.Security.Cryptography.X509Certificates.X509Certificate.ThrowIfInvalid()
at System.Security.Cryptography.X509Certificates.X509Certificate.get_Subject()

The reason is that validation callback passed to SslStream (RemoteCertificateValidationCallback) receives certificate that is disposed by caller (SecureChannel.VerifyRemoteCertificate()) just after validation (it adds it to chain which is disposed after validation). Unfortunately, the implementation of callback in HttpConnection constructor saves the received certificate to field to be later presented as result of GetClientCertificate().

Currently I see no other way how to get the working certificate than to use reflection to dig into the internal objects to get underlying SslStream which has correct certificate in RemoteCertificate property.

[davidsh]

With .NET Core, HttpListener on Linux does NOT support TLS/SSL. This is a known feature limitation.

We recommend you using ASP.NET Core server 'Kestrel'.

[davidsh]

Duplicate of #19752

[martin-frydl]

First, we have WHOLE application built on HttpListener. Second, we've made that mistake to port from .NET framework to .NET core instead of rewriting everything to Java (we should not use .NET in the first place though). Third, I was unable to find ANY documentation how to use Kestrel other than ASP.NET pages - zillions of tutorials for the same. I want servlet API with full access to certificates, request, responses... Just like old HttpListener. And last, it IS usable for SSL right now, just via reflection.

[davidsh]

Kestrel documentation is here: https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-3.1

If you have additional questions on Kestrel, you can open an issue at dotnet/aspnetcore repo.

@Tratcher @anurse