Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Client Certificate does not work on .NET 6.0 on MacOS #80490

Closed
lucaslra opened this issue Jan 11, 2023 · 11 comments
Closed

Client Certificate does not work on .NET 6.0 on MacOS #80490

lucaslra opened this issue Jan 11, 2023 · 11 comments
Assignees
@wfurt
Labels
area-System.Net.Security os-mac-os-x macOS aka OSX
Milestone
6.0.x

Comments

@lucaslra
Copy link

lucaslra commented Jan 11, 2023 •
edited
Loading

Description

When I make a simple https call with HttpClient using a Client certificate, I get this error:

<html> <head><title>400 The SSL certificate error</title></head> <body> <center><h1>400 Bad Request</h1></center> <center>The SSL certificate error</center> <hr><center>nginx</center> </body> </html>

The tricky part is that this ONLY happens if:

  • I am using .NET 6.0 (both .NET Core 3.1 and .NET 7 works fine)
  • I am running on a Mac machine (The .NET 6.0 version works fine running on a Linux container)

Reproduction Steps

  • Be on a Mac running Ventura
  • Use .NET 6
  • Make a call to a WebAPI that requires Client certificate for authentication

I wrote some code that reproduces the problem, but might be tricky since I cannot share the API I am pointing to:

const string url = "https://myservice";
const string path = "myendpoint";
var fileData = File.ReadAllBytes("/some/certificate.p12");
var certificate = new X509Certificate2(fileData, "the_cert_password");
var handler = new HttpClientHandler
{
    ClientCertificateOptions = ClientCertificateOption.Manual
};
handler.ClientCertificates.Add(certificate);

var httpClient = new HttpClient(handler)
{
    BaseAddress = new Uri(url)
};

var httpMessage = new HttpRequestMessage
{
    Content = new StringContent("{}", Encoding.UTF8, "application/json"),
    Method = HttpMethod.Post,
    RequestUri = new Uri($"{httpClient.BaseAddress}{path}")
};
var result = await httpClient.SendAsync(httpMessage);
var content = await result.Content.ReadAsStringAsync();

Console.WriteLine(content);

Expected behavior

To be properly authenticated and get a valid response from the server

Actual behavior

<html> <head><title>400 The SSL certificate error</title></head> <body> <center><h1>400 Bad Request</h1></center> <center>The SSL certificate error</center> <hr><center>nginx</center> </body> </html>

Regression?

No response

Known Workarounds

Use .NET Core 3.1 or .NET 7.0 (not valid on my situation though)

Configuration

.NET 6.0.9
MacOS Ventura 13.0.1
x64

Other information

No response
@ghost ghost added the untriaged New issue has not been triaged by the area owner label Jan 11, 2023
@ghost
Copy link

ghost commented Jan 11, 2023

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

Description

When I make a simple https call with HttpClient using a Client certificate, I get this error:

<html> <head><title>400 The SSL certificate error</title></head> <body> <center><h1>400 Bad Request</h1></center> <center>The SSL certificate error</center> <hr><center>nginx</center> </body> </html>

The tricky part is that this ONLY happens if:

  • I am using .NET 6.0 (both .NET Core 3.1 and .NET 7 works fine)
  • I am running on a Mac machine (The .NET 6.0 version works fine running on a Linux container)

Reproduction Steps

  • Be on a Mac running Ventura
  • Use .NET 6
  • Make a call to a WebAPI that requires Client certificate for authentication

I wrote some code that reproduces the problem, but might be tricky since I cannot share the API I am pointing to:

const string url = "https://myservice";
const string path = "myendpoint";
var fileData = File.ReadAllBytes("/some/certificate.p12");
var certificate = new X509Certificate2(fileData, "the_cert_password");
var handler = new HttpClientHandler
{
    ClientCertificateOptions = ClientCertificateOption.Manual
};
handler.ClientCertificates.Add(certificate);

var httpClient = new HttpClient(handler)
{
    BaseAddress = new Uri(url)
};

var httpMessage = new HttpRequestMessage
{
    Content = new StringContent("{}", Encoding.UTF8, "application/json"),
    Method = HttpMethod.Post,
    RequestUri = new Uri($"{httpClient.BaseAddress}{path}")
};
var result = await httpClient.SendAsync(httpMessage);
var content = await result.Content.ReadAsStringAsync();

Console.WriteLine(content);

Expected behavior

To be properly authenticated and get a valid response from the server

Actual behavior

<html> <head><title>400 The SSL certificate error</title></head> <body> <center><h1>400 Bad Request</h1></center> <center>The SSL certificate error</center> <hr><center>nginx</center> </body> </html>

Regression?

No response

Known Workarounds

Use .NET Core 3.1 or .NET 7.0 (not valid on my situation though)

Configuration

.NET 6.0.9
MacOS Ventura 13.0.1
x64

Other information

No response

Author: lucaslra
Assignees: -
Labels:

area-System.Net.Security, untriaged
Milestone: -

@wfurt wfurt added os-mac-os-x macOS aka OSX needs-author-action An issue or pull request that requires more info or actions from the author. labels Jan 11, 2023
@wfurt
Copy link
Member

wfurt commented Jan 11, 2023 •
edited
Loading

Can you check if this is dup of #66537 @lucaslra?
I'm not sure if #73574 would qualify for servicing so moving to 7.0 may be only one option.

@ghost
Copy link

ghost commented Jan 11, 2023

This issue has been marked needs-author-action and may be missing some important information.

@lucaslra
Copy link
Author

Moving to 7.0 is not an option in my case, since it is not LTS, would have to move back to 3.1 and I REALLY want to avoid that.
On the topic of being a duplicate of #66537, it could be, but I am not sure to be honest.

@ghost ghost added needs-further-triage Issue has been initially triaged, but needs deeper consideration or reconsideration and removed needs-author-action An issue or pull request that requires more info or actions from the author. labels Jan 11, 2023
@wfurt
Copy link
Member

wfurt commented Jan 11, 2023

To see if the issue is really dup of #66537 you should get packet captures of the handshake with Wireshark. Server will send "CertificateRequest" and client will send 0 or more certificates as response.
Compare what client is sending in working and non-woking case.

3.1 is out of support. You can try to convince @karelz but the servicing decision is really out of our hands.

@lucaslra
Copy link
Author

Sorry if the information is shallow, but yes, I see clear differences between the certificate packages sent by my client, depending on the .NET version

.NET 6 seems to send 1 certificate less, so I guess that this makes it a duplicate of #66537?

6.0 looks like:
image

3.1 looks like:
image

@rzikm
Copy link
Member

rzikm commented Jan 12, 2023

.NET 6 seems to send 1 certificate less, so I guess that this makes it a duplicate of #66537?

Yes.

We will see if this meets the bar for servicing and update this issue later.

@karelz karelz removed the needs-further-triage Issue has been initially triaged, but needs deeper consideration or reconsideration label Jan 24, 2023
@wfurt
Copy link
Member

wfurt commented Jan 26, 2023

can you somehow quantify the impact @lucaslra? We will need some justification for servicing approval. You can send me details to my GH email.

@karelz
Copy link
Member

karelz commented Jan 31, 2023

@lucaslra any details on the impact? Without additional info we won't be able to service it.

@rzikm rzikm removed the untriaged New issue has not been triaged by the area owner label Feb 7, 2023
@karelz
Copy link
Member

karelz commented Feb 9, 2023

@lucaslra ping?

@karelz
Copy link
Member

karelz commented Feb 21, 2023

Missing details on impact - no response for 1 month. Closing.
Feel free to reopen when there is more information for us to make 6.0 servicing decision. Thanks!

@karelz karelz closed this as completed Feb 21, 2023
@karelz karelz added this to the 6.0.x milestone Feb 21, 2023
@ghost ghost locked as resolved and limited conversation to collaborators Mar 24, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@wfurt wfurt

Labels
area-System.Net.Security os-mac-os-x macOS aka OSX
Projects
None yet
Milestone
6.0.x
Development

No branches or pull requests
5 participants
@vcsjones @lucaslra @karelz @wfurt @rzikm