Runtime: HttpClient with Certificates not supported

[essensoft-roc]

system: centos 7.3
runtime: dotnet core 2.0.0

Code:

var x509Certificate2 = new X509Certificate2();  // Replace this class instantation with actual X509Certificate2 data
var httpClientHandler = new HttpClientHandler();
httpClientHandler.ClientCertificates.Add(x509Certificate2);
using (var httpClient = new HttpClient(httpClientHandler))
{
    // Post
}

Error:

fail: Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware[0]
      An unhandled exception has occurred: The handler does not support client authentication certificates with this combination of libcurl (7.29.0) and its SSL backend ("NSS/3.28.4").
System.PlatformNotSupportedException: The handler does not support client authentication certificates with this combination of libcurl (7.29.0) and its SSL backend ("NSS/3.28.4").
   at System.Net.Http.CurlHandler.SslProvider.SetSslOptionsForUnsupportedBackend(EasyRequest easy, ClientCertificateProvider certProvider)
   at System.Net.Http.CurlHandler.SslProvider.SetSslOptions(EasyRequest easy, ClientCertificateOption clientCertOption)
   at System.Net.Http.CurlHandler.EasyRequest.InitializeCurl()
   at System.Net.Http.CurlHandler.MultiAgent.ActivateNewRequest(EasyRequest easy)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at System.Net.Http.HttpClient.<FinishSendAsyncBuffered>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()

[ghost]

The current code does not work well with anything but OpenSSL 1.0. If your ServerCertificateCustomValidationCallback property whilst using your unsupported SSL library does not accept all (which it shouldn't, as that is a bit of a security problem), then it will always throw the error you have seen.

if (easy._handler.ServerCertificateCustomValidationCallback != null)
{
    if (easy.ServerCertificateValidationCallbackAcceptsAll)
    {
        EventSourceTrace("Warning: Disabling peer and host verification per {0}", nameof(HttpClientHandler.DangerousAcceptAnyServerCertificateValidator), easy: easy);
        easy.SetCurlOption(Interop.Http.CURLoption.CURLOPT_SSL_VERIFYPEER, 0);
        easy.SetCurlOption(Interop.Http.CURLoption.CURLOPT_SSL_VERIFYHOST, 0);
    }
    else
    {
        throw new PlatformNotSupportedException(SR.Format(SR.net_http_libcurl_callback_notsupported, CurlVersionDescription, CurlSslVersionDescription));
    }
}

Your solution for this would be to install a version of libcurl that is built with an OpenSSL back-end (instead of NSS). This comment: https://github.com/dotnet/corefx/issues/9728#issuecomment-286251370 details what a member of the core team recommends.

[essensoft-roc]

@elsyms Thank you #9728 (comment)

[essensoft-roc]

sudo yum update
sudo yum install openssl-devel

wget https://curl.haxx.se/download/curl-7.55.1.tar.gz
tar -zxf curl-7.55.1.tar.gz
cd curl-7.55.1
./configure --prefix=/usr/local/curl/ --without-nss --with-ssl=/usr/local/ssl/
make && make install

[MonikaMalik123]

System - Linux 7.3
Run -Time - dotnet core 2.0.0

I am running dotnet Core 2.0 application on this container (registry.access.redhat.com/dotnet/dotnet-20-rhel7:latest) in linux 7.3, but when login to application and enter password gives me this error - "One or more errors occurred. (The handler does not support custom handling of certificates with this combination of libcurl (7.29.0) and its SSL backend ("NSS/3.28.3").)"
FYI - This application works fine on Windows.

Please suggest me any resolution for this issue? Much Appreciated if anyone can help me with this

Thanks

[wfurt]

recommendation from @elsyms should work. .net currently does not support NSS for callbacks.
@tmds may have some other recommendations. There may be some alternative version with openssl

[kishoretvk]

does this also affect windows servers too? i'm getting file not found in path exception but when i try to add the keyset it says, can;t find credentials?

[davidsh]

does this also affect windows servers too? i'm getting file not found in path exception but when i try to add the keyset it says, can;t find credentials?

@kishoretvk If you are having a problem on Windows with Http APIs and client certificates, please open a new issue. Please include a code sample of how you are using the APIs so we can try to repro the problem. Thx.

[tmds]

I hadn't noticed this issue before...

system: centos 7.3 runtime: dotnet core 2.0.0

@EssenRoc The dotnet packages that are built for RHEL are also available for CentOS and they include a recent version of libcurl+openssl. https://www.microsoft.com/net/download/linux-package-manager/rhel/sdk-2.0.3 has installation instructions.

I am running dotnet Core 2.0 application on this container (registry.access.redhat.com/dotnet/dotnet-20-rhel7:latest) in linux 7.3, but when login to application and enter password gives me this error - "One or more errors occurred. (The handler does not support custom handling of certificates with this combination of libcurl (7.29.0) and its SSL backend ("NSS/3.28.3").)"

@MonikaMalik123 That image contains the updated version of libcurl+openssl. There is a known issue that this is not used for stand-alone applications (SCD). If you deploy framework dependent (FDD) then your app will work.

[kishoretvk]

Hey, sorry for delayed reply, but here u go, on IIS, we have a setting "load user profile"
in the application pool settings, if it's turned on to be true, certificates load successfully.
will post more details about my problem were below:
i was getting "certificate not found exception!"
to fix it i had to turn on load user profile on IIS
Reasoning: from MSdn and Stackoverflow
This is most likely because the Windows Cryptographic Service Provider was trying to store or load a key for your certificate in the user store, and since a profile was not available, a cryptographic context was not available. Note that the Load User Profile setting only applies to user accounts. Service Accounts like NETWORK SERVICE and ApplicationPoolIdentity have special handling.