Paket: mono paket fails sporadically with ssl exception during web requests

[enricosada]

Description

With mono, sporadically (~ 4 %) of times, paket fails making a web request, with an ssl exception

Repro steps

using mono (repro with 5.4) doing repeated paket update

Expected behavior

paket works as expected, doing correct web requests

Actual behavior

paket fails with exception doing a web request

-> Could not find versions for package Nancy on https://www.nuget.org/api/v2.
-> Source 'https://www.nuget.org/api/v2' yielded no results
    -  Request 'https://www.nuget.org/api/v2/FindPackagesById()?semVerLevel=2.0.0&id='Nancy'' finished with error
    -> Could not retrieve data from 'https://www.nuget.org/api/v2/FindPackagesById()?semVerLevel=2.0.0&id='Nancy''
    -> HttpRequestException: An error occurred while sending the request
    -> WebException: Error: TrustFailure (One or more errors occurred.)
    -> AuthenticationException: A call to SSPI failed, see inner exception.
    -> MonoBtlsException: Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
         at /build/mono-5.4.1.7/external/boringssl/ssl/handshake_client.c:1132
    -  Request 'https://www.nuget.org/api/v2/Packages?semVerLevel=2.0.0&$filter=Id eq 'Nancy'' finished with error
    -> Could not retrieve data from 'https://www.nuget.org/api/v2/Packages?semVerLevel=2.0.0&$filter=tolower(Id) eq 'nancy''
    -> HttpRequestException: An error occurred while sending the request
    -> WebException: Error: TrustFailure (One or more errors occurred.)
    -> AuthenticationException: A call to SSPI failed, see inner exception.
    -> MonoBtlsException: Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
         at /build/mono-5.4.1.7/external/boringssl/ssl/handshake_client.c:1132

real issue is

MonoBtlsException: Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED

Known workarounds

retry.

Additional info

reference issue https://bugzilla.xamarin.com/show_bug.cgi?id=57516 in mono bug tracker

Environment

mono 5.4.1.7 on ubuntu

[enricosada]

while waiting for a mono fixed version may be good enough, is annoying in the integration test suite running on travis.

Paket should retry when that specific expection, so is more robust for users too.

[TheAngryByrd]

Your Mono's cert store might be out of date. To sync it with mozilla's root certs use the following command:

curl https://curl.haxx.se/ca/cacert.pem > ~/cacert.pem && sudo cert-sync ~/cacert.pem

[ShalokShalom]

Thanks. I had this issue every time and @TheAngryByrd solved it for me. ^-^

[enricosada]

Feedback from @eiriktsarpalis using latest mono, who may be useful to others

adding the env var MONO_TLS_PROVIDER=legacy fix the issue

To add it to docker:

ENV MONO_TLS_PROVIDER=legacy