Runtime: A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: SSL Provider, error: 31 - Encryption(ssl/tls) handshake failed) RHEL 7

[jbruce716]

I'm unable to connect to our MSSQL database instance from RHEL &, but if I launch my app using dotnet on Windows 10, it connects as expected.

os version
cat /etc/*-release

  NAME="Red Hat Enterprise Linux Server"
  VERSION="7.5 (Maipo)"
  ID="rhel"
  ID_LIKE="fedora"
  VARIANT="Server"
  VARIANT_ID="server"
  VERSION_ID="7.5"
  PRETTY_NAME="Red Hat Enterprise Linux Server 7.5 (Maipo)"
  ANSI_COLOR="0;31"
  CPE_NAME="cpe:/o:redhat:enterprise_linux:7.5:GA:server"
  HOME_URL="https://www.redhat.com/"
  BUG_REPORT_URL="https://bugzilla.redhat.com/"

 REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 7"
 REDHAT_BUGZILLA_PRODUCT_VERSION=7.5
 REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
 REDHAT_SUPPORT_PRODUCT_VERSION="7.5"

 Red Hat Enterprise Linux Server release 7.5 (Maipo)
 Red Hat Enterprise Linux Server release 7.5 (Maipo)

net core version
dotnet --info

.NET Core SDK (reflecting any global.json):
 Version:   2.1.302
 Commit:    9048955601

Runtime Environment:
  OS Name:     rhel
  OS Version:  7
  OS Platform: Linux
  RID:         rhel.7-x64
  Base Path:   /usr/share/dotnet/sdk/2.1.302/

Host (useful for support):
  Version: 2.1.2
  Commit:  811c3ce6c0

.NET Core SDKs installed:
  2.1.302 [/usr/share/dotnet/sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.2 [/usr/share/dotnet/shared/Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.2 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.2 [/usr/share/dotnet/shared/Microsoft.NETCore.App]

systemd service definition
cat /etc/systemd/system/kestrel-service.service

[Unit]
Description=placeholder

[Service]
WorkingDirectory=/var/www/placeholder-api
ExecStart=/usr/bin/dotnet /var/www/placeholder-api/Placeholder.Api.dll
Restart=always
# Restart service after 10 seconds if the dotnet service crashes:
RestartSec=10
SyslogIdentifier=placeholder-api-dev
User=svc_account
Environment=ASPNETCORE_ENVIRONMENT=Development

[Install]
WantedBy=multi-user.target

There's a comment on dotnet/runtime#26388 that says:

if the user running the service is set to root then there is no exception thrown, with any other user this exception is thrown

However, we don't have the ability to switch to root in our environment.
Please let me know if I need to add any more information or if I've missed this reported somewhere else.

[ruben-herold]

hi,

in our environment (also Centos7) the fix was to correct broken links in /etc/ssl/certs an make all files readable for the user running the dotnet service.

Seems that dotnet does not handle broken or non readable files in the correct way (ignoring them and log warning). ....

Hope the the people will fix this fast.

[keeratsingh]

@jbruce716 Could you kindly try @ruben-herold's suggestions and see if that resolves your issue ?

Seems that dotnet does not handle broken or non readable files in the correct way (ignoring them and log warning).

@bartonjs Would you happen to know if this is expected behavior or potential enhancement/bug ?

[bartonjs]

Sounds like yet another duplicate of https://github.com/dotnet/corefx/issues/29942. The fix is in 2.1.3, which has not shipped yet. (Seems rather like https://github.com/dotnet/corefx/issues/30147, specifically)

Somewhere in /etc/ssl/certs there's a file that your process can't read (no permissions, or broken symlink). If you can solve that, the problem will go away.

[jbruce716]

@bartonjs Yes, this is similar, but I didn't know if a different OS warranted a separate ticket, and dotnet/runtime#26388 was closed. (Sorry if I made the wrong choice)

@keeratsingh I will give @ruben-herold's suggestion a shot tomorrow, I need to finish an API for a different project first though

UPDATE - I gave our service account read rights for the directory /etc/ssl/certs and everything is working now

@ruben-herold You're awesome!