Identityserver4: .NET CORE 2.1 - System.InvalidOperationException: IDX20803: Unable to obtain configuration from: 'http://<identityserv>/.well-known/openid-configuration'

Created on 2 Oct 2018  路  20Comments  路  Source: IdentityServer/IdentityServer4

Issue / Steps to reproduce the problem

I am using IdentityServer4 along with ASP.NET Identity as an authentication service for my API.
Implemented Implicit flow for an Angular Client.
API is developed on .NET Core 2.1 uses IdentityServer4.AccessTokenValidation 2.6.0 (also tried with 2.7.0-preview-1)

It all worked file in my local machine. However, having some issue upon deploying onto Azure websites.
It looks like Http call made internally to get configuration is failing.
System.InvalidOperationException: IDX20803: Unable to obtain configuration from: 'http://<identityserv>/.well-known/openid-configuration'

I am able to access the above URL directly from browser. I suspect this to be related to the below-mentioned change in .NET Core 2.1.
https://github.com/IdentityServer/IdentityServer4/issues/2311

Tried all the options from the below links but no luck. Anyone had this issue?
https://github.com/dotnet/core/blob/master/release-notes/2.1/2.1.0.md

Also tried - AppContext.SetSwitch("System.Net.Http.UseSocketsHttpHandler", false);

Relevant parts of the log file

System.InvalidOperationException: IDX20803: Unable to obtain configuration from: 'http://<domain>/.well-known/openid-configuration'.
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.AuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
   at IdentityServer4.AccessTokenValidation.IdentityServerAuthenticationHandler.HandleAuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.AuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Builder.Extensions.MapWhenMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Server.IISIntegration.IISMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
2018-10-02T13:22:41.8747963+01:00 0HLH8C6E1CJML:00000001 [ERR] Connection id ""0HLH8C6E1CJML"", Request id ""0HLH8C6E1CJML:00000001"": An unhandled exception was thrown by the application. (560e7d32)
question
Source
picture anilchinnu21

Most helpful comment

I know it's a tls error - I read through the entire stack trace before posting.

What I'm trying to understand is why I can hit the same well-known endpoint with a browser without errors, but when idsvr does it as part of validation of a bearer token, it gets the error.

I'm sorry I'm not a tls expert and I have tried to find solutions elsewhere. Using certutil to install nss certs into my personal store (ie, under $HOME) didn't work. Adding certs under /usr/local/share/ca-certificates (if memory serves) and running the update command (which recognized that there was a new certificate) didn't work - for server-to-server comms _only_. Browser is, I repeat, fine (Chrome shows site is certified on my endpoints and the idsvr endpoints).

That's the whole reason for raising here. I've obviously missed something and I was really hoping that someone might have a clue what.

picture fluffynuts on 7 Nov 2018
👍7

All 20 comments

Not sure. 1) I'd expect https, not http. 2) can you view that URL in your browser?

brockallen picture brockallen on 3 Oct 2018
👍1

Able to view the URL. No issues with it.

anilchinnu21 picture anilchinnu21 on 6 Oct 2018

So again, not sure. But given that all the namespaces start with "Microsoft", perhaps that's who you should reach out to?

brockallen picture brockallen on 6 Oct 2018

After updating to the latest .net core SDK I have the identical issue

alexfestbaum picture alexfestbaum on 17 Oct 2018

Any update?

brockallen picture brockallen on 19 Oct 2018

I would like to add that I am also experiencing an issue after upgrading to Asp.Net Core 2.1. I have a web app that communicates with an API that in turns communicates with IdentityServer4. The web application can successfully login with IdentityServer, obtain an access token and call the API. When the API tries to validate the token it gets the same exception the original poster presented. I am using a developer environment consisting of Windows 7 IIS and Visual Studio 2017. I have tried using both AddDeveloperSigningCredential and self-signed certificate from my local systems trusted root. Below is the code I currently have for IdentityServer4 and the API configuartion. This has been modified from my original code based on other articles that I have been researching in trying to find a solution to this issue.

For troubleshooting purposes I have eliminated the Web application component from the equation by using PostMan to post directly to the API and IdentityServer4. I am able to obtain a token using OAuth 2.0 and the Web client鈥檚 secret/credential. Posting to the API causes the error mentioned. I get the token with no issue and can navigate to the .well-known via a browser with no issues.

IDENTITYSERVER4 configuration edited for brevity and relevant parts, relevant NuGet packages (IdentityServer4.AspNetIdentity v2.1.0 and Microsoft.AspNetCore.App v2.1.1 )

```C#
public void ConfigureServices(IServiceCollection services)
{
services.AddDbContext(options =>
options.UseSqlServer(Configuration.GetConnectionString(dbConnectionName)));

        services.AddIdentity<ApplicationUser, IdentityRole>()
            .AddEntityFrameworkStores<ApplicationDbContext>()
            .AddDefaultTokenProviders();

        services.AddIdentityServer()
            //.AddSigningCredential(X509.GetCertificate("<finds cert in store>"))   // tried as possible solution                
            .AddDeveloperSigningCredential()
            .AddAspNetIdentity<ApplicationUser>()
            .AddProfileService<ProfileService>()
            .AddConfigurationStore(options =>
            {
                options.ConfigureDbContext = builder =>
                    builder.UseSqlServer(connectionString);
            })
            .AddOperationalStore(options =>
            {
                options.ConfigureDbContext = builder =>
                builder.UseSqlServer(connectionString);
            });

        services.AddAuthentication(IdentityConstants.ApplicationScheme);  //added based on recent research in trying to solve issue

        services.AddMvc(o =>
        {
            o.RespectBrowserAcceptHeader = true;
            o.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
        }).AddJsonOptions(options =>
        {
            options.SerializerSettings.ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore;
        })
        .SetCompatibilityVersion(CompatibilityVersion.Version_2_1); //added when updated to 2.1

}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory, UserManager userManager, ILogger logger)
{

        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            app.UseHsts();
        }


        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseCookiePolicy(); //added based on recent research in trying to solve issue

        app.UseIdentityServer();

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Account}/{action=Login}/{id?}");
        });

}


API configuration edited for brevity and relevant parts, relevant NuGet packages (IdentityServer4.AccessTokenValidation v2.6.0 and Microsoft.AspNetCore.App v2.1.1 )

```C#
public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvcCore()
                .AddAuthorization()
                .AddJsonFormatters(o => o.ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore) 
                .AddMvcOptions(o =>
                {
                    o.RespectBrowserAcceptHeader = true;
                    o.Filters.Add(typeof(CustomExceptionFilter));
                    var policy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().AddAuthenticationSchemes(IdentityServerAuthenticationDefaults.AuthenticationScheme).Build();
                    o.Filters.Add(new AuthorizeFilter(policy));
                })
                .AddDataAnnotations()

            //tells the api to use IdentityServer as it's authentication services
            services.AddAuthentication(o => 
            {
                o.DefaultScheme = IdentityServerAuthenticationDefaults.AuthenticationScheme;
                o.DefaultAuthenticateScheme = IdentityServerAuthenticationDefaults.AuthenticationScheme;

            })
                .AddIdentityServerAuthentication(options =>
                {
                    options.Authority = Configuration["ApplicationSetting:Identity:Authority"];
                    options.RequireHttpsMetadata = false;
                    options.ApiName = "apiiam";
                });
#if DEBUG
            IdentityModelEventSource.ShowPII = true;
#endif
        }

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseAuthentication();

            app.UseMvc();

}
rickloveland picture rickloveland on 24 Oct 2018

I'm having similar troubles -- but only on Linux. On Windows, the developer cert worked just fine. I thought that perhaps generating a pfx of my own and using that would fix the problem, but no joy. I'm using the same cert for https for the asp.net app (not sure if that's a bad idea?) and have it installed locally, such that Chrome trusts the site (Firefox complains, but Firefox has its own store).

The interesting bits of my config below:

            services.AddAuthentication(opts =>
                {
                    opts.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                    opts.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
                })
                .AddJwtBearer(opts =>
                {
                    opts.Authority = AppSettings.Authority; // "https://localhost:5002";
                    opts.RequireHttpsMetadata = false;
                    opts.TokenValidationParameters = new TokenValidationParameters()
                    {
                        ValidateAudience = true,
                        ValidAudiences = new[]
                        {
                            $"{opts.Authority}/resources",
                            AppSettings.ApiResourceName
                        }
                    };
                });
            services.AddIdentityServer(
                    opts =>
                        opts.Events.RaiseSuccessEvents =
                            opts.Events.RaiseFailureEvents =
                                opts.Events.RaiseErrorEvents = true
                )
//                .AddDeveloperSigningCredential()
                .AddSigningCredential(CertFinder.Certificate)
                // TODO: abstract out where this data comes from
                .AddInMemoryClients(clients)
                .AddInMemoryIdentityResources(identityResources)
                .AddInMemoryApiResources(apiResources)
                .AddProfileService<UserProfileService>()
                .AddResourceOwnerValidator<UserValidatorService>();

I can hit .well-known/openid-configuration with a get just fine, as long as I don't have a bearer token in my headers: presence of a token causes all comms to die with:

fail: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[3]
      Exception occurred while processing message.
System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. ---> System.IO.IOException: IDX20804: Unable to retrieve document from: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Security.SslState.ThrowIfExceptional()
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)
   at System.Net.Security.SslStream.<>c.<AuthenticateAsClientAsync>b__47_1(IAsyncResult iar)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.CreateConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.WaitForCreatedConnectionAsync(ValueTask`1 creationTask)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HLI0FGLE03HG", Request id "0HLI0FGLE03HG:00000001": An unhandled exception was thrown by the application.
System.InvalidOperationException: IDX20803: Unable to obtain configuration from: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. ---> System.IO.IOException: IDX20804: Unable to retrieve document from: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslState.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Security.SslState.ThrowIfExceptional()
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)
   at System.Net.Security.SslStream.<>c.<AuthenticateAsClientAsync>b__47_1(IAsyncResult iar)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.CreateConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.WaitForCreatedConnectionAsync(ValueTask`1 creationTask)
   at System.Threading.Tasks.ValueTask`1.get_Result()
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.AuthenticateAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context)
   at IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context) in C:\local\identity\server4\IdentityServer4\src\IdentityServer4\Hosting\BaseUrlMiddleware.cs:line 36
   at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
   at Sigma.Api.Middleware.ErrorHandling.CustomExceptionHandlerMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in /home/daf/code/codeo/super-data-sigma-web/src/api/Sigma.Api/Middleware/ErrorHandling/CustomExceptionHandlingMiddleware.cs:line 23
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass5_1.<<UseMiddlewareInterface>b__1>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Sigma.Api.Middleware.ErrorHandling.HttpExceptionHandlerMiddleware.InvokeAsync(HttpContext context, RequestDelegate next) in /home/daf/code/codeo/super-data-sigma-web/src/api/Sigma.Api/Middleware/ErrorHandling/HttpExceptionHandlerMiddleware.cs:line 17
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions.<>c__DisplayClass5_1.<<UseMiddlewareInterface>b__1>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Cors.Infrastructure.CorsMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
fluffynuts picture fluffynuts on 2 Nov 2018

The remote certificate is invalid according to the validation procedure

This is the error. It's a TLS/HTTPS issue, which is environmental/configuration related. There are several issues in the history that you can look at for various solutions.

brockallen picture brockallen on 4 Nov 2018

I know it's a tls error - I read through the entire stack trace before posting.

What I'm trying to understand is why I can hit the same well-known endpoint with a browser without errors, but when idsvr does it as part of validation of a bearer token, it gets the error.

I'm sorry I'm not a tls expert and I have tried to find solutions elsewhere. Using certutil to install nss certs into my personal store (ie, under $HOME) didn't work. Adding certs under /usr/local/share/ca-certificates (if memory serves) and running the update command (which recognized that there was a new certificate) didn't work - for server-to-server comms _only_. Browser is, I repeat, fine (Chrome shows site is certified on my endpoints and the idsvr endpoints).

That's the whole reason for raising here. I've obviously missed something and I was really hoping that someone might have a clue what.

fluffynuts picture fluffynuts on 7 Nov 2018
👍7

Sorry, I don't either.

brockallen picture brockallen on 7 Nov 2018

I'm also having the same error. To clarify I'm trying to use ROPC to get a bearer token, but when I try to hit a secure end point with that token I get this error.

mmartin25 picture mmartin25 on 20 Nov 2018

I know it's a tls error - I read through the entire stack trace before posting.

What I'm trying to understand is why I can hit the same well-known endpoint with a browser without errors, but when idsvr does it as part of validation of a bearer token, it gets the error.

I'm sorry I'm not a tls expert and I have tried to find solutions elsewhere. Using certutil to install nss certs into my personal store (ie, under $HOME) didn't work. Adding certs under /usr/local/share/ca-certificates (if memory serves) and running the update command (which recognized that there was a new certificate) didn't work - for server-to-server comms _only_. Browser is, I repeat, fine (Chrome shows site is certified on my endpoints and the idsvr endpoints).

That's the whole reason for raising here. I've obviously missed something and I was really hoping that someone might have a clue _what_.

@fluffynuts Did you ever get a solid lead to this issue? I've been killing myself trying to make this work for the last week, so I feel your pain.
Update
I was using an ip address and an ssl certificate issued from a CA. Adding host entries on development mac (for the mobile app) and server hosting the asp.net core api pointing the host name the certificate was registered under to the ip address got me past this error because it allowed the computers in question to trust the certificate (even though it is a valid certificate).

mmartin25 picture mmartin25 on 20 Nov 2018

i am having the same issue with mine but i am running it on an localhost. is there an solution to this found or not yet

D252874 picture D252874 on 17 Apr 2019

I was also having the same issue, i changed .Net target framework from 4.5 to 4.6.1 and that solve the issue. probably it was TLS version issue.

mdislam04 picture mdislam04 on 23 Apr 2019

@mmartin25 you asked if I'd had any resolution. The short answer is "no", but the longer answer appears to be that it's an issue in dotnet core, specifically with respect to system-trusted certificates on !windows. No matter how I attempt to register a certificate, dotnet core b0rks on it, where other clients accept it.
I've had to abandon localhost development under Linux on the project and use Windows for dev, unfortunately. I was really looking forward to using my preferred platform, but I guess that will have to wait until dotnet core behaves.

fluffynuts picture fluffynuts on 26 Apr 2019

Adding below application setting to the App Service on azure works for me
Key : WEBSITE_LOAD_CERTIFICATES
Value: *
i also used a key and certificate from sslforfree used openssl to generate the .pfx which was uploaded to azure App Service -> SSL.

the application settings was added to the Identity server 4 .net core and the client app as well.
i hope it helps

samabos picture samabos on 2 May 2019

https://github.com/IdentityServer/IdentityServer4/issues/2672#issuecomment-432746204

@rickloveland
Did you find solution for this?

csharpq picture csharpq on 25 May 2019

Esto es por el proxy de la Organizaci贸n, SOLUCION:

en Internet Options LocalAreaNetwork is your proxy.

in webConfig


Daniel5000 picture Daniel5000 on 3 Oct 2019

I'd expect https, not http.

Exactly. Putting "http://" fixed the issue for me.

maxkaft picture maxkaft on 7 Nov 2019

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

lock[bot] picture lock[bot] on 10 Jan 2020
Was this page helpful?
0 / 5 - 0 ratings

Related issues

leastprivilege picture leastprivilege  路  3Comments
osmankibar picture osmankibar  路  3Comments
Aravind1729 picture Aravind1729  路  3Comments
agilenut picture agilenut  路  3Comments
garymacpherson picture garymacpherson  路  3Comments