Eventstore: ProjectionsManager usage over HTTPS localhost failing - SSL Error

[WhatFor]

Describe the bug
Connecting to the ClientAPI using the ClientAPI ProjectionsManager yields an SSL exception, while typical consumption of the EventStore connection (EventStoreConnection.Create) over HTTPS works as expected.

To Reproduce
Below is the configuration and code used to reproduce.

EventStore args
EventStore.ClusterNode.exe --db ../db --log ../logs --enable-external-tcp --run-projections=all --config=./config.yaml

EventStore YAML

TrustedRootCertificatesPath: ./
CertificateStoreLocation: CurrentUser
CertificateStoreName: My
CertificateThumbPrint: {---THUMBPRINT REMOVED---}
CertificateSubjectName: CN=eventstore.com
EnableAtomPubOverHttp: True

var man = new ProjectionsManager(
   new ConsoleLogger(),
   new IPEndPoint(IPAddress.Loopback, 2113),
   TimeSpan.FromSeconds(5));

var conn = EventStoreConnection.Create("ConnectTo=tcp://username:password@localhost:1113; HeartBeatTimeout=500;UseSslConnection=true;TargetHost=eventstore.org;ValidateServer=false");

// Exceptions thrown here
var result = await man.ListContinuousAsync(conn.Settings.DefaultUserCredentials);

Actual behavior

When attempting to call an authenticated endpoint using ProjectionsManager over HTTPS on the same host, the below exception is thrown.

If attempting to configure the connection over HTTP instead, a different exception is thrown (The response ended prematurely.). I am aware that EventStore is HTTPS only as off 20.6.0, so this is to be expected.

The Client API is on default port 2113, and configured as such in my application. The ClientCredentials used in the ProjectionsManager call is extracted from the IEventStoreConnection, and is known to be correct.

ProjectionsManager over HTTP Exception

System.AggregateException: One or more errors occurred. (One or more errors occurred. (An error occurred while sending the request.))
 ---> System.AggregateException: One or more errors occurred. (An error occurred while sending the request.)
 ---> System.Net.Http.HttpRequestException: An error occurred while sending the request.
 ---> System.IO.IOException: The response ended prematurely.
   at async ValueTask System.Net.Http.HttpConnection.FillAsync()
   at void System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable+ConfiguredValueTaskAwaiter.GetResult()
   at async ValueTask<ArraySegment<byte>> System.Net.Http.HttpConnection.ReadNextResponseHeaderLineAsync(bool foldedHeadersAllowed)
   at TResult System.Threading.Tasks.ValueTask<TResult>.get_Result()
   at TResult System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable<TResult>+ConfiguredValueTaskAwaiter.GetResult()
   at async Task<HttpResponseMessage> System.Net.Http.HttpConnection.SendAsyncCore(HttpRequestMessage request, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at async Task<HttpResponseMessage> System.Net.Http.HttpConnection.SendAsyncCore(HttpRequestMessage request, CancellationToken cancellationToken)
   at async Task<HttpResponseMessage> System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, bool doRequestAuth, CancellationToken cancellationToken)
   at async Task<HttpResponseMessage> System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at async Task<HttpResponseMessage> System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task<HttpResponseMessage> sendTask, HttpRequestMessage request, CancellationTokenSource cts, bool disposeCts, CancellationToken callerToken, long timeoutTime)
   --- End of inner exception stack trace ---
   at TResult System.Threading.Tasks.Task<TResult>.GetResultCore(bool waitCompletionNotification)
   at TResult System.Threading.Tasks.Task<TResult>.get_Result()
   at Action<Task<HttpResponseMessage>> EventStore.ClientAPI.Transport.Http.HttpAsyncClient.RequestSent(ClientOperationState state)+(Task<HttpResponseMessage> task) => { }
   --- End of inner exception stack trace ---
   at Task<List<ProjectionDetails>> EventStore.ClientAPI.Projections.ProjectionsClient.ListContinuous(EndPoint endPoint, UserCredentials userCredentials, string httpSchema)+(Task<string> x) => { }
   at void System.Threading.Tasks.ContinuationResultTaskFromResultTask<TAntecedentResult, TResult>.InnerInvoke()
   at void System.Threading.Tasks.Task.s_ecCallback(object obj)
   at void System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, object state)
   at void System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, object state)

ProjectionsManager over HTTPS Exception

System.AggregateException: One or more errors occurred. (One or more errors occurred. (The SSL connection could not be established, see inner exception.))
New invoice count for Id: 44
 ---> System.AggregateException: One or more errors occurred. (The SSL connection could not be established, see inner exception.)
 ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
   at void System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception)
   at async Task System.Net.Security.SslStream.ForceAuthenticationAsync<TIOAdapter>(TIOAdapter adapter, bool receiveFirst, byte[] reAuthenticationData, bool isApm)
   at async ValueTask<SslStream> System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at async ValueTask<SslStream> System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   at TResult System.Threading.Tasks.ValueTask<TResult>.get_Result()
   at TResult System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable<TResult>+ConfiguredValueTaskAwaiter.GetResult()
   at async ValueTask<ValueTuple<Socket, Stream, TransportContext, HttpResponseMessage>> System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, bool allowHttp2, CancellationToken cancellationToken)
   at TResult System.Threading.Tasks.ValueTask<TResult>.get_Result()
   at TResult System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable<TResult>+ConfiguredValueTaskAwaiter.GetResult()
   at async ValueTask<ValueTuple<HttpConnection, HttpResponseMessage>> System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at TResult System.Threading.Tasks.ValueTask<TResult>.get_Result()
   at TResult System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable<TResult>+ConfiguredValueTaskAwaiter.GetResult()
   at async ValueTask<(HttpConnectionBase connection, bool isNewConnection, HttpResponseMessage failureResponse)> System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at TResult System.Threading.Tasks.ValueTask<TResult>.get_Result()
   at TResult System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable<TResult>+ConfiguredValueTaskAwaiter.GetResult()
   at async Task<HttpResponseMessage> System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, bool doRequestAuth, CancellationToken cancellationToken)
   at async Task<HttpResponseMessage> System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at async Task<HttpResponseMessage> System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task<HttpResponseMessage> sendTask, HttpRequestMessage request, CancellationTokenSource cts, bool disposeCts, CancellationToken callerToken, long timeoutTime)
   --- End of inner exception stack trace ---
   at TResult System.Threading.Tasks.Task<TResult>.GetResultCore(bool waitCompletionNotification)
   at TResult System.Threading.Tasks.Task<TResult>.get_Result()
   at Action<Task<HttpResponseMessage>> EventStore.ClientAPI.Transport.Http.HttpAsyncClient.RequestSent(ClientOperationState state)+(Task<HttpResponseMessage> task) => { }
   --- End of inner exception stack trace ---
   at Task<List<ProjectionDetails>> EventStore.ClientAPI.Projections.ProjectionsClient.ListContinuous(EndPoint endPoint, UserCredentials userCredentials, string httpSchema)+(Task<string> x) => { }
   at void System.Threading.Tasks.ContinuationResultTaskFromResultTask<TAntecedentResult, TResult>.InnerInvoke()
   at void System.Threading.Tasks.Task.s_ecCallback(object obj)
   at void System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, object state)
   at void System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, object state)

Config/Logs/Screenshots

EventStore logs

[20592, 1,21:29:39.751,INF]
INTERFACES
External TCP (Protobuf)
        Enabled : True
        Port    : 1113
HTTP (AtomPub)
        Enabled : True
        Port    : 2113

[20592, 1,21:29:39.751,WRN]
 DEPRECATION WARNING: AtomPub over HTTP Interface has been deprecated as of version 20.02. It is recommended to use gRPC instead.

[20592, 1,21:29:39.751,WRN]
 DEPRECATION WARNING: The Legacy TCP Client Interface has been deprecated as of version 20.02. The External TCP Interface can be re-enabled with the 'EnableExternalTCP' option. It is recommended to use gRPC instead.

[20592, 1,21:29:39.759,INF] Quorum size set to 1
[20592, 1,21:29:39.779,INF] Trusted root certificate file loaded: "escert.cer"
[20592, 1,21:29:39.786,INF] Cannot find plugins path: "C:\\ProgramData\\chocolatey\\lib\\eventstore-oss\\tools\\EventStore-OSS-Windows-2019-v20.6.0\\plugins"
[20592, 1,21:29:39.883,DBG] MessageHierarchy initialization took 00:00:00.0760010.
[20592, 1,21:29:39.889,INF] "INSTANCE ID:"            12db5f54-8720-4193-9a66-9a713c5d5713
[20592, 1,21:29:39.889,INF] "DATABASE:"               "../db"
[20592, 1,21:29:39.889,INF] "WRITER CHECKPOINT:"      70987 (0x1154B)
[20592, 1,21:29:39.889,INF] "CHASER CHECKPOINT:"      70987 (0x1154B)
[20592, 1,21:29:39.889,INF] "EPOCH CHECKPOINT:"       69368 (0x10EF8)
[20592, 1,21:29:39.889,INF] "TRUNCATE CHECKPOINT:"    -1 (0xFFFFFFFFFFFFFFFF)
[20592, 1,21:29:44.395,DBG] Opened ongoing "../db\\chunk-000000.000000" as version 3
[20592, 1,21:29:44.400,DBG] CACHED TFChunk "#0-0 (chunk-000000.000000)" in 00:00:00.0007934.
[20592, 1,21:29:44.541,INF] Starting MiniWeb for "/web/es/js/projections" ==> "C:\\ProgramData\\chocolatey\\lib\\eventstore-oss\\tools\\EventStore-OSS-Windows-2019-v20.6.0\\projections"
[20592, 1,21:29:44.541,INF] Starting MiniWeb for "/web/es/js/projections/v8/Prelude" ==> "C:\\ProgramData\\chocolatey\\lib\\eventstore-oss\\tools\\EventStore-OSS-Windows-2019-v20.6.0\\Prelude"
[20592, 1,21:29:44.546,INF] Starting MiniWeb for "/web" ==> "C:\\ProgramData\\chocolatey\\lib\\eventstore-oss\\tools\\EventStore-OSS-Windows-2019-v20.6.0\\clusternode-web"
[20592,13,21:29:44.582,INF] ========== ["127.0.0.1:2113"] SYSTEM INIT...
[20592,13,21:29:44.583,INF] Starting "Secure" TCP listening on TCP endpoint: "127.0.0.1:1113".
[20592,15,21:29:44.585,INF] TableIndex initialization...
[20592,13,21:29:44.587,INF] ========== ["127.0.0.1:2113"] Service '"StorageReader"' initialized.
[20592,13,21:29:44.587,INF] ========== ["127.0.0.1:2113"] Service '"StorageWriter"' initialized.
[20592,15,21:29:44.588,INF] ReadIndex building...
[20592,15,21:29:44.603,DBG] ReadIndex rebuilding done: total processed 318 records, time elapsed: 00:00:00.0148318.
[20592,13,21:29:44.609,INF] ========== ["127.0.0.1:2113"] Service '"StorageChaser"' initialized.
[20592,13,21:29:44.609,INF] ========== ["127.0.0.1:2113"] SYSTEM START...
[20592,13,21:29:44.610,INF] ========== ["127.0.0.1:2113"] IS UNKNOWN...
[20592, 9,21:29:44.611,DBG] Persistent subscriptions received state change to Unknown. Stopping listening
[20592,13,21:29:44.611,INF] ELECTIONS: STARTING ELECTIONS.
[20592,13,21:29:44.612,INF] ELECTIONS: (V=0) SHIFT TO LEADER ELECTION.
[20592,13,21:29:44.612,INF] ELECTIONS: (V=0) VIEWCHANGE FROM ["Unspecified/127.0.0.1:2113", {12db5f54-8720-4193-9a66-9a713c5d5713}].
[20592,13,21:29:44.613,INF] ELECTIONS: (V=0) MAJORITY OF VIEWCHANGE.
[20592,13,21:29:44.613,INF] ELECTIONS: (V=0) SHIFT TO PREPARE PHASE.
[20592,13,21:29:44.614,INF] ELECTIONS: (V=0) PREPARE_OK FROM "[Unspecified/127.0.0.1:2113,{12db5f54-8720-4193-9a66-9a713c5d5713}](L=70652,W=70987,C=70987,E7@69368:{5eb6c58d-fc94-4448-be5f-c8947ab66464} (L={0b386e75-45e4-40a1-a6f5-68143a001ea6}),Priority=0)".
[20592,13,21:29:44.614,INF] ELECTIONS: (V=0) SHIFT TO REG_LEADER.
[20592,13,21:29:44.618,DBG] ELECTIONS: (V=0) Previous Leader (L={0b386e75-45e4-40a1-a6f5-68143a001ea6}) from last epoch record is dead, defaulting to the best candidate (B={12db5f54-8720-4193-9a66-9a713c5d5713}).
[20592,13,21:29:44.618,DBG] ELECTIONS: (V=0) Proposing node: {12db5f54-8720-4193-9a66-9a713c5d5713} as best leader candidate
[20592,13,21:29:44.618,INF] ELECTIONS: (V=0) SENDING PROPOSAL CANDIDATE: "[Unspecified/127.0.0.1:2113,{12db5f54-8720-4193-9a66-9a713c5d5713}](L=70652,W=70987,C=70987,E7@69368:{5eb6c58d-fc94-4448-be5f-c8947ab66464} (L={0b386e75-45e4-40a1-a6f5-68143a001ea6}),Priority=0)", ME: "[Unspecified/127.0.0.1:2113,{12db5f54-8720-4193-9a66-9a713c5d5713}](L=70652,W=70987,C=70987,E7@69368:{5eb6c58d-fc94-4448-be5f-c8947ab66464} (L={0b386e75-45e4-40a1-a6f5-68143a001ea6}),Priority=0)".
[20592,13,21:29:44.619,INF] ELECTIONS: (V=0) ACCEPT FROM ["Unspecified/127.0.0.1:2113",{12db5f54-8720-4193-9a66-9a713c5d5713}] M=["Unspecified/127.0.0.1:2113",{12db5f54-8720-4193-9a66-9a713c5d5713}]).
[20592,13,21:29:44.619,INF] ELECTIONS: (V=0) DONE. ELECTED LEADER = "[Unspecified/127.0.0.1:2113,{12db5f54-8720-4193-9a66-9a713c5d5713}](L=70652,W=70987,C=70987,E7@69368:{5eb6c58d-fc94-4448-be5f-c8947ab66464} (L={0b386e75-45e4-40a1-a6f5-68143a001ea6}),Priority=0)". ME="[Unspecified/127.0.0.1:2113,{12db5f54-8720-4193-9a66-9a713c5d5713}](L=70652,W=70987,C=70987,E7@69368:{5eb6c58d-fc94-4448-be5f-c8947ab66464} (L={0b386e75-45e4-40a1-a6f5-68143a001ea6}),Priority=0)".
[20592,13,21:29:44.620,INF] ========== ["127.0.0.1:2113"] PRE-LEADER STATE, WAITING FOR CHASER TO CATCH UP...
[20592, 9,21:29:44.620,DBG] Persistent subscriptions received state change to PreLeader. Stopping listening
[20592,13,21:29:44.621,INF] ========== ["127.0.0.1:2113"] IS LEADER... SPARTA!
[20592, 9,21:29:44.621,DBG] Persistent subscriptions Became Leader so now handling subscriptions
[20592,13,21:29:44.621,DBG] Searching for incomplete scavenges on node "127.0.0.1:2113".
[20592,13,21:29:44.625,DBG] Max age and $ops read permission already set for the "$scavenges" stream.
[20592,13,21:29:44.628,DBG] No incomplete scavenges found on node "127.0.0.1:2113".
[20592,24,21:29:44.630,INF] PROJECTIONS SUBSYSTEM: Starting components for Instance: b2fa81a3-4534-434f-ae64-727c1e3ca67f
[20592,24,21:29:44.630,DBG] PROJECTIONS: Projection Core Coordinator component starting. Correlation: b2fa81a3-4534-434f-ae64-727c1e3ca67f
[20592,24,21:29:44.631,DBG] PROJECTIONS: Starting Projections Core Coordinator
[20592,24,21:29:44.631,DBG] PROJECTIONS: Starting Projections Manager. Correlation: b2fa81a3-4534-434f-ae64-727c1e3ca67f
[20592,24,21:29:44.632,DBG] PROJECTIONS: Reading Existing Projections from "$projections-$all"
[20592,24,21:29:44.632,DBG] PROJECTIONS SUBSYSTEM: Component '"ProjectionManager"' started for Instance: b2fa81a3-4534-434f-ae64-727c1e3ca67f
[20592,11,21:29:44.637,DBG] === Writing E8@70987:{9e7337d8-e224-441e-99e2-d7983b302cfa} (previous epoch at 69368). L={12db5f54-8720-4193-9a66-9a713c5d5713}.
[20592,24,21:29:44.638,DBG] PROJECTIONS: Found the following projections in "$projections-$all": ["$streams", "$stream_by_category", "$by_category", "$by_event_type", "$by_correlation_id"]
[20592,24,21:29:44.640,DBG] Adding projection a99f4f3c-fa57-4fbf-aec7-10608a566ebb@"$streams" to list
[20592,24,21:29:44.640,DBG] Adding projection 5d2f637a-9d33-4717-9578-82337779a9de@"$stream_by_category" to list
[20592,24,21:29:44.640,DBG] Adding projection 641e3ccc-692a-4fd2-bcbe-114929d28780@"$by_category" to list
[20592,24,21:29:44.640,DBG] Adding projection 45154899-8073-44e8-88f9-832ecac1bce4@"$by_event_type" to list
[20592,24,21:29:44.640,DBG] Adding projection b50a398d-c81c-4f52-8421-626c321ed04c@"$by_correlation_id" to list
[20592,11,21:29:44.640,DBG] === Update Last Epoch E8@70987:{9e7337d8-e224-441e-99e2-d7983b302cfa} (previous epoch at 69368) L={12db5f54-8720-4193-9a66-9a713c5d5713}.
[20592,24,21:29:44.640,DBG] PROJECTIONS: SubComponent Started: "EventReaderCoreService"
[20592,24,21:29:44.640,DBG] PROJECTIONS: SubComponent Started: "EventReaderCoreService"
[20592,24,21:29:44.640,DBG] PROJECTIONS: SubComponent Started: "EventReaderCoreService"
[20592,24,21:29:44.640,DBG] PROJECTIONS: SubComponent Started: "ProjectionCoreService"
[20592,24,21:29:44.640,DBG] PROJECTIONS: SubComponent Started: "ProjectionCoreService"
[20592,24,21:29:44.640,DBG] PROJECTIONS: SubComponent Started: "ProjectionCoreService"
[20592,24,21:29:44.641,DBG] PROJECTIONS SUBSYSTEM: Component '"ProjectionCoreCoordinator"' started for Instance: b2fa81a3-4534-434f-ae64-727c1e3ca67f
[20592,24,21:29:44.641,INF] PROJECTIONS SUBSYSTEM: All components started for Instance: b2fa81a3-4534-434f-ae64-727c1e3ca67f
[20592,13,21:29:44.641,INF] ========== ["127.0.0.1:2113"] Sub System '"Projections"' initialized.
[20592, 5,21:29:45.054,DBG] Segments count: 1, buffers count: 512, should be when full: 512
TcpConnectionSsl::InitClientSocket(127.0.0.1:52693, L127.0.0.1:1113)
[20592, 5,21:29:45.083,INF] External TCP connection accepted: [Secure, "127.0.0.1:52693", L"127.0.0.1:1113", {a6b46407-2500-481d-8e2a-bdf86d123520}].
[20592, 6,21:29:45.089,INF] [S"127.0.0.1:52693", L"127.0.0.1:1113"]
[20592, 6,21:29:45.089,INF] Cipher: Aes256
[20592, 6,21:29:45.089,INF] Cipher strength: 256
[20592, 6,21:29:45.089,INF] Hash: Sha384
[20592, 6,21:29:45.089,INF] Hash strength: 0
[20592, 6,21:29:45.089,INF] Key exchange: 44550
[20592, 6,21:29:45.089,INF] Key exchange strength: 384
[20592, 6,21:29:45.089,INF] Protocol: Tls12
[20592, 6,21:29:45.089,INF] Is authenticated: True as server? True
[20592, 6,21:29:45.089,INF] IsSigned: True
[20592, 6,21:29:45.089,INF] Is Encrypted: True
[20592, 6,21:29:45.089,INF] Can read: True, write True
[20592, 6,21:29:45.089,INF] Can timeout: True
[20592, 6,21:29:45.089,INF] Certificate revocation list checked: False
[20592, 6,21:29:45.089,INF] Local certificate was issued to "CN=eventstore.com" and is valid from "26/07/2020 14:17:33" until "26/07/2021 14:37:33".
[20592, 6,21:29:45.089,INF] Remote certificate is null.
[20592, 6,21:29:45.152,INF] Connection '"external-secure"' ({a6b46407-2500-481d-8e2a-bdf86d123520}) identified by client. Client connection name: '"ES-82b3a79d-6e8a-4cf8-afbd-f489d97c853e"', Client version: V2.
[20592,17,21:29:46.181,DBG] Segments count: 1, buffers count: 20, should be when full: 20

EventStore details

• EventStore server version: 20.6.0

• Operating system: Windows 10 Pro 10.0.19041 Build 19041

• EventStore client version (if applicable): 20.6.0

Additional context
Running on .NET 5, Preview 7

[WhatFor]

For a complete picture, I've tried to tweak the cert a bit, generating a new one for localhost.

YAML:
CertificateSubjectName: CN=localhost
Thumbprint updated to new cert.

Connection string:
"ConnectTo=tcp://username:password@localhost:1113; HeartBeatTimeout=500;UseSslConnection=true;TargetHost=localhost;ValidateServer=false"

With the same Exception being thrown.

[hayley-jean]

Are the certificates you are using trusted by the machine?

Alternatively, you should be able to bypass certificate verification in the client by setting a custom httpMessageHandler like this:

var messageHandler = new SocketsHttpHandler
{
    SslOptions =
    {
        RemoteCertificateValidationCallback = delegate { return true; }
    }
};

[WhatFor]

Yes, the certificate is in the Trusted Root certs.

If possible, can you offer me some clarification on whether the single cert defined in the YAML config is used for both the TCP/Protobuf AND the HTTP/AtomPub services please? Is there any documentation on this anywhere, as I've been unable to find much on it at all.

I can confirm the SocketsHttpHandler workaround does work, but I would still like to get to the bottom of this. 👍

Thank you for your response, hayley.

[KaranSoluteLab]

I got exception when creating a projection using .net client in my API. here is exception
'The SSL connection could not be established.
The remote certificate is invalid according to the validation procedure.'

This exception generated when i use below code to create projection. this occurs at CreateContinuousAsync.
ProjectionsManager Projection = new ProjectionsManager(new ConsoleLogger(), new IPEndPoint(IPAddress.Parse("127.0.0.1"), 2113), TimeSpan.FromMilliseconds(5000)); Projection.CreateContinuousAsync(projectionModel.ProjectionName, projectionModel.ProjectionQuery).Wait();

I am running event store in dev mode with below start command EventStore.ClusterNode.exe --dev --enable-external-tcp --disable-external-tcp-tls --run-projections=all --start-standard-projections=true

I already had issue Here of disabling the tls when connecting to event store. so i assume that may be i have to disable tls for this issue?,
if yes then how can i do it?

Thanks for Help!

[hayley-jean]

@WhatFor Yes, the certificate used is the same one used for TCP and HTTP. Documentation is still to come, but there is some explanation on how to set it up in the release notes here.

If the SocketsHttpHandler workaround works, then the issue is likely to do with the certificate setup.
The next thing to check is that the IP address of the server you are contacting is in the SAN of the certificate used by the server. In this case, the IP Address of "127.0.0.1" would be needed in the certificate's SAN.

@KaranSoluteLab DisableExternalTcpTls only disables TLS for TCP. The Projections Manager isn't affected by this setting as it runs over HTTPS by default.
If you are running in development mode, you can use the same suggestion of changing the HTTP Message Handler as I gave to @WhatFor above when creating your projections manager.

An Insecure mode and better documentation is slated to come with version 20.6.1.

[AbdoDabbas]

Any idea when the fix will be available?

[alexeyzimarev]

@AbdoDabbas we are still working on 20.6.1 where the dev mode will change slightly and the insecure mode will be introduced. But, the insecure mode is already available in the nightly build, you can use the container from the GitHub container repository.

[AbdoDabbas]

I tried the nightly build 2020-08-09-nightly (installed the EventStore-OSS-Windows-2019-v2020-08-09-nightly.zip package), I used this command in PowerShell:

.\EventStore.ClusterNode.exe --db ./db --log ./logs --run-projections=all --start-standard-projections --dev --enable-external-tcp --disable-external-tcp-tls --insecure

I can open the Admin UI and write new streams, but when I try to enable a projection I'm getting an error message about SSL, even though I disabled TLS in code and when running EventStore node:

System.AggregateException: 'One or more errors occurred. (One or more errors occurred. (The SSL connection could not be established, see inner exception.))'

Here's the code I used:
```C#
var endpoint = new IPEndPoint(IPAddress.Loopback, 1113);

var cred = new UserCredentials("admin", "changeit");

var settings = ConnectionSettings.Create()
.DisableTls()
.DisableServerCertificateValidation()
.KeepReconnecting()
.KeepRetrying()
.SetGossipSeedEndPoints(endpoint)
.SetClusterGossipPort(2113)
.SetHeartbeatInterval(TimeSpan.FromSeconds(30))
.SetGossipTimeout(TimeSpan.FromMinutes(5))
.SetHeartbeatTimeout(TimeSpan.FromMinutes(5))
.SetTimeoutCheckPeriodTo(TimeSpan.FromMinutes(1))
.SetDefaultUserCredentials(cred);

var connection = EventStoreConnection.Create(settings, endpoint, "TestApp");

connection.ConnectAsync().Wait();

var manager = new ProjectionsManager(connection.Settings.Log,
connection.Settings.GossipSeeds[0].EndPoint, TimeSpan.FromSeconds(30));

manager.EnableAsync("$by_category", connection.Settings.DefaultUserCredentials).Wait();
```

[hayley-jean]

Hi @AbdoDabbas the ProjectionsManager uses HTTPS by default. If you are running with insecure mode you will still need to set the protocol when creating the ProjectionsManager:

var manager = new ProjectionsManager(connection.Settings.Log,
    connection.Settings.GossipSeeds[0].EndPoint, TimeSpan.FromSeconds(30), "http");

[AbdoDabbas]

@hayley-jean , looks like the SSL issue is gone, but now it's throwing another exception (3 inner exception actually):

System.AggregateException: 'One or more errors occurred. (One or more errors occurred. (An error occurred while sending the request.))'
AggregateException: 127.0.0.1:1113_category/comman

[hayley-jean]

Please can you ensure that your gossip seed endpoints are set to the external http endpoints of the nodes in the cluster.
By default, this would be {ip_address}:2113

If you are not running in a cluster, you should create the ProjectionsManager with just the external http endpoint of the single node. By default this would be:

var manager = new ProjectionsManager(connection.Settings.Log,
    new IPEndPoint(IPAddress.Loopback, 2113), TimeSpan.FromSeconds(30), "http");