Identityserver4: Problem when enabling HTTPS on the test server

[DeeDeeLee]

I developed an asp.net project which integrated IDS4 for authentication, and authorization successfully on my local machine with HTTPS enabled.
When I published the IDS4 to the Test/Staging server, asp.net project can get authenticated if the IDS4 is using HTTP. It failed if IDS4 is using HTTPS.

I used asp.net core 2.0.5
IdentityServer4 2.2.0
IdentityServer4.AccessTokenValidation 2.4.0
This is the log content from stdout file.

An existing connection was forcibly closed by the remote host 
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

--
Exception Details: System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host


--

An unhandled exception   was generated during the execution of the current web request. Information   regarding the origin and location of the exception can be identified using   the exception stack trace below.
--

[SocketException (0x2746): An   existing connection was forcibly closed by the remote host]        System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult) +82      System.Net.Sockets.NetworkStream.EndRead(IAsyncResult   asyncResult) +57       [IOException: Unable to read   data from the transport connection: An existing connection was forcibly   closed by the remote host.]      System.Net.TlsStream.EndWrite(IAsyncResult   asyncResult) +232        System.Net.PooledStream.EndWrite(IAsyncResult asyncResult) +13        System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) +119       [WebException: The underlying   connection was closed: An unexpected error occurred on a send.]      System.Net.HttpWebRequest.EndGetResponse(IAsyncResult   asyncResult) +628        System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)   +64       [HttpRequestException: An   error occurred while sending the request.]      System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        System.Net.Http.<FinishSendAsyncBuffered>d__58.MoveNext() +745      System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.IdentityModel.Protocols.<GetDocumentAsync>d__8.MoveNext()   +362       [IOException: IDX20804:   Unable to retrieve document from: '[PII is hidden by default. Set the   'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'.]        Microsoft.IdentityModel.Protocols.<GetDocumentAsync>d__8.MoveNext()   +666        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.IdentityModel.Protocols.OpenIdConnect.<GetAsync>d__3.MoveNext()   +291      System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task) +25        Microsoft.IdentityModel.Protocols.<GetConfigurationAsync>d__24.MoveNext()   +1129       [InvalidOperationException:   IDX20803: Unable to obtain configuration from: '[PII is hidden by default.   Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal   it.]'.]      Microsoft.IdentityModel.Protocols.<GetConfigurationAsync>d__24.MoveNext()   +1586        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58      Microsoft.Owin.Security.OpenIdConnect.<ApplyResponseChallengeAsync>d__c.MoveNext()   +575        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58      Microsoft.Owin.Security.Infrastructure.<ApplyResponseCoreAsync>d__b.MoveNext()   +282        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.Owin.Security.Infrastructure.<ApplyResponseAsync>d__8.MoveNext()   +275        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.Owin.Security.Infrastructure.<TeardownAsync>d__5.MoveNext()   +160        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.Owin.Security.Infrastructure.<Invoke>d__0.MoveNext()   +815        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.<RunApp>d__5.MoveNext()   +182        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.Owin.Security.Infrastructure.<Invoke>d__0.MoveNext()   +638        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.<RunApp>d__5.MoveNext()   +182        System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task   task) +99        System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task   task) +58        Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.<DoFinalWork>d__2.MoveNext()   +180        Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.StageAsyncResult.End(IAsyncResult   ar) +69      Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContext.EndFinalWork(IAsyncResult   ar) +64        System.Web.AsyncEventExecutionStep.InvokeEndHandler(IAsyncResult ar)   +156        System.Web.AsyncEventExecutionStep.OnAsyncEventCompletion(IAsyncResult   ar) +123
--







--

[DeeDeeLee]

Server Error when enabling HTTPS.docx

[brockallen]

Not sure, but it sounds like something we saw recently. Is your app using IdentityModel? Can you update your app to use one consistent version of it?

[DeeDeeLee]

It looks like that the IdentityServer4 (2.2.0) is using "IdentityModel 3.6.1". How and where could I get the consistent version of it?

[brockallen]

is your host referencing it too? if so, does it need to?

[DeeDeeLee]

My IDS4 is referencing identityserver4(2.2.0), not identitymodel directly.

[DeeDeeLee]

Today I have tried to deploy the release version of IdentityServer4 ( IdentityServer4-release.zip downloaded from your site without the change). it has the same issue. The .Net core client works, but ASP.NET client doesn't work for IDS4 with the HTTPS enabled.

[brockallen]

Sorry, not sure.

[vsubbotskyy]

@DeeDeeLee, I encountered the same issue and seems like it happens because of incompatible TLS versions. Check your target framework version and TLS settings. I performed a quick test setting ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12; and it worked.

[savbace]

Adding some more insights to @vsubbotskyy's answer.

This could be related to TLS version problem: when you're making calls using client that doesn't support TLS version of server.
More details here: https://stackoverflow.com/questions/45382254/update-net-web-service-to-use-tls-1-2

And if you're publishing to Azure: https://azure.microsoft.com/en-us/updates/new-app-service-apps-deployed-with-tls-1-2-as-default-from-june-30/

Hope it helps.

[DeeDeeLee]

@vsubbotskyy and @savbace, thank you so much for your help. After I changed the target framework version to 4.6.1 in the web.config, it worked.

Thanks again,

[MadhurBhardwaj]

I'm also getting same exception when my web api is trying to get document from wellknown-endpoint.
surprisingly same code is working on one server, but not on other. Identity server is version 4 (.NET core) and web API is on full framework. how I can check this TLS version is it at OS level or IIS setting?

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.