SSL RemoteCertificateNameMismatch on MacOS Catalina #666
Comments
Dotnet-GitSync-Bot
added
area-System.Net.Http
untriaged
|
Do you use environment variables or do you set proxy explicitly in via API? Short code fragment would be nice for clarity how to reproduce it. |
|
And do you have LANG=en_US.UTF-8 or do you have locale set to anything else? |
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>netcoreapp3.0</TargetFramework>
</PropertyGroup>
</Project>using System;
using System.Net;
using System.Net.Http;
using System.Net.Security;
namespace proxytest
{
public class WebProxy : IWebProxy
{
public ICredentials Credentials { get; set; }
public Uri GetProxy(Uri destination)
{
return new Uri("http://127.0.0.1:9090");
}
public bool IsBypassed(Uri host)
{
return false;
}
}
class Program
{
static void Main(string[] args)
{
Console.WriteLine("Hello World!");
using (HttpClientHandler clientHandler = new HttpClientHandler())
{
clientHandler.Proxy = new WebProxy();
clientHandler.ServerCertificateCustomValidationCallback = (sender, certificate, chain, sslPolicyErrors) =>
{
if (sslPolicyErrors == SslPolicyErrors.None)
{
return true;
}
else
{
Console.WriteLine($"SSL ERROR:{sslPolicyErrors.ToString()}");
Console.WriteLine(sender.RequestUri.AbsoluteUri);
Console.WriteLine(certificate.ToString(true));
return false;
}
};
using (var httpClient = new HttpClient(clientHandler))
{
var result = httpClient.GetStringAsync("https://github.com").GetAwaiter().GetResult();
Console.WriteLine(result);
}
}
}
}
}ting@htl-mac proxytest % printenv|sort
HOME=/Users/ting
LANG=en_US.UTF-8
LOGNAME=ting
LaunchInstanceID=42DF0CC6-7E63-405A-B233-8A6E7C29719A
OLDPWD=/Users/ting/Desktop
PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/go/bin:/usr/local/share/dotnet:~/.dotnet/tools
PWD=/Users/ting/Desktop/proxytest
SECURITYSESSIONID=186a6
SHELL=/bin/zsh
SHLVL=1
SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.CEawhAXvQp/Listeners
TERM=xterm-256color
TERM_PROGRAM=Apple_Terminal
TERM_PROGRAM_VERSION=433
TERM_SESSION_ID=A8A7F4C6-E8A2-4C32-9954-A6D7295908A4
TMPDIR=/var/folders/h1/nkrscyxx6858j3wz7dvzcq5r0000gn/T/
USER=ting
XPC_FLAGS=0x0
XPC_SERVICE_NAME=0
_=/usr/bin/printenv |
|
I was not able to reproduce it @TingluoHuang and I do see decrypted response details in Proxyman GUI. cc: @bartonjs in case he has some ideas. |
|
We let the OS determine whether or not the hostname matches (https://github.com/dotnet/corefx/blob/release/3.0/src/Native/Unix/System.Security.Cryptography.Native.Apple/pal_ssl.c#L357-L462). Maybe something else is going on that's making things return false, but essentially we and Safari should have the same answer. |
davidsh
added
needs more info
and removed
untriaged
|
On that note, Proxyman changes OS setting so it should be easy to test. |
|
I tried Safari, it works fine with Proxyman, SSL traffic in Safari get decrypted correctly. |
|
I can reproduce it on Catalina. I will take a look. |
|
It looks like we get |
|
Since Safari works fine with Proxyman, i assume there might be some different between Safari and Netcore ask OS to validate SSL cert, maybe some validation option difference. |
|
I'm still not sure what exactly is going on as Catalina sources are not available yet. |
wfurt
changed the title
|
I think perhaps Apple started requiring the EKU as per the CAB/F baseline requirements in 10.15. Apple has a support article on this here: https://support.apple.com/en-us/HT210176
|
|
Proxyman fixed their CA cert and server certs when decrypt https traffic. |
|
Glad things are working for you now 😄. |
|
Was there more info we could have included in the exception that might have made this quicker to understand (like CSSMERR_APPLETP_INVALID_EXTENDED_KEY_USAGE)? |
ghost
locked as resolved and limited conversation to collaborators
I am using Proxyman to decrypt https traffic from my self-contained netcore 3.0 console app on macOS. Like using Fiddler on Windows.
I am getting
System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.with inner exceptionSystem.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedurewhen the proxy is on.I added a customize
ServerCertificateCustomValidationCallbackto dump out the ssl error, request url and the certificate.The request url's authority seems match with the cert's CN.
If i
export DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER=0to force my app use the old curl http handler, the SSL error goes away.So I am not sure why I am getting SSL error on when use SocketHttpHandler.
The text was updated successfully, but these errors were encountered: