Skip to content

Mutual TLS won't work with HttpClientHandler

0

Hi, I have a simple console app that sends a certificate.pfx with password, enforcing SSlProtocol to TLS1.2 to an AWS ALB, the cyphers have been installed on windows server 2019. Unfortunately we keep on receiving an error message. (SSL connection could not be establish. Unable to read data from the transport connection: connection reset by peer) . On the other hand a simple program in python with certificates converted to *.pem with opensll pkcs12- it passes and is able to do the handshake with a TLS 1.3. We suspect that the certificate added to the HttpClientHandler doesn't pass the certificate to the ALB. The logs from the ALB errors shows 443 TLS 1.2 ECDHE-RSA-AES128-GCM-SHA256 - "-" - Failled: UnmappedConnectionError TID_....

asked 2 years ago293 views

3 Answers
0
Accepted Answer

The solution to his problem was that the httpClientHandler did not pass the certificate to the ALB. The library SocketsHttpHandler was capable on passing the certificate and perform the handshake with the ALB(Mutual TLS).

answered 2 years ago

0

Assuming the ALB's HTTPS listener isn't set to use the TLS security policy ELBSecurityPolicy-TLS13-1-3-2021-06 that requires TLS 1.3 (https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html#tls-protocols), it sounds likely that you may be right and that your client application just isn't presenting the client certificate when connecting to the ALB.

Are you using the same certificate, just converted with openssl between the file formats, or are these two completely separate client certificates? You also mentioned that the failing certificate/private key file is encrypted. Just to eliminate the obvious, is the client program using the passphrase to decrypt the private key?

EXPERT

answered 2 years ago

0

Are you using the same certificate, just converted with openssl between the file formats, or are these two completely separate client certificates? Is the same certificate.pfx converted into 2 files *.pem 1 containing the certificate and the other containing the private key

You also mentioned that the failing certificate/private key file is encrypted. Just to eliminate the obvious, is the client program using the passphrase to decrypt the private key? With the dotnet is initialize as fallows new X509Certificat2(certificateFile, certificatePassphrase);

Tests have also been performed with curl in linux and Invoke-Webrequest in powershell and they work! So this problems is related with the dotnet libraries ....

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.