Invalid Remote Certificate with .NET Core HttpClient in Linux Container

Question

I have a wildcard Certificate issued by letsencrypt (*.stg.foo.com)
Two .NET Core Applications in a docker container running behind a Nginx are listening to admin.stg.foo.com and srv.stg.foo.com

This Setup so far seems to work as expected. I can access my containers through a browser and the certificate is valid.

If I run a curl from a container to another it works as expected

 curl https://admin.stg.foo.com/ -v
 ALPN, offering h2
...
ALPN, offering http/1.1
 successfully set certificate verify locations:
   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
 TLSv1.3 (OUT), TLS handshake, Client hello (1):
 TLSv1.3 (IN), TLS handshake, Server hello (2):
 TLSv1.2 (IN), TLS handshake, Certificate (11):
 TLSv1.2 (IN), TLS handshake, Server key exchange (12):
 TLSv1.2 (IN), TLS handshake, Server finished (14):
 TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
 TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
 TLSv1.2 (OUT), TLS handshake, Finished (20):
 TLSv1.2 (IN), TLS handshake, Finished (20):
 SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
 ALPN, server accepted to use h2
 Server certificate:
  subject: CN=.stg.foo.com
  start date: Jul  8 04:50:10 2020 GMT
  expire date: Oct  6 04:50:10 2020 GMT
  subjectAltName: host "admin.stg.foo.com" matched cert's "*.stg.foo.com"
  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
  SSL certificate verify ok.

If I try to do the same request from a docker container with a HttpClient the certificate validation fails with: The remote certificate is invalid according to the validation procedure:

    Unhandled exception. System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
   at System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)

Test Code:

        using (HttpClient client = new HttpClient())
        {
            var result = await client.GetAsync("https://admin.stg.foo.com/.well-known/openid-configuration");
            Console.WriteLine(await result.Content.ReadAsStringAsync());
            result.EnsureSuccessStatusCode();
        }

The same request running on a Windows Machine works.

Does .NET use another folder for certs than curl (/etc/ssl/certs)? Are there more logs to debug .Net Core Cert Errors?

Setup:

.NET Core 3.1.5
Ubuntu 20.04 LTS

Thanks for Help

Edit:

Found Similar Issue: The remote certificate is invalid according to the validation procedure

Invalid Remote Certificate with .NET Core HttpClient in Linux Container

0 Answers