Why could not SSL connection be established?

[harshwd]

Issue

I have deployed Ocelot Gateway(.Net 6) and downstream services in Azure containers app (running with https endpoint). When trying to call gateway with endpoint than I am getting error - The SSL connection could not be established.

Error

 022-12-08T04:34:38.991456610Z       requestId: 0HMMOQH2IOKKP:00000008, previousRequestId: no previous request id, message: No authentication needed for /api/jobs/jobStatus
2022-12-08T04:34:38.991474211Z info: Ocelot.Authorization.Middleware.AuthorizationMiddleware[0]
2022-12-08T04:34:38.991479011Z       requestId: 0HMMOQH2IOKKP:00000008, previousRequestId: no previous request id, message: /api/jobs/jobStatus route does not require user to be authorized
2022-12-08T04:34:38.998306991Z warn: Ocelot.Responder.Middleware.ResponderMiddleware[0]
2022-12-08T04:34:38.998346591Z       requestId: 0HMMOQH2IOKKP:00000008, previousRequestId: no previous request id, message: Error Code: ConnectionToDownstreamServiceError Message: Error connecting to downstream service, exception: System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
2022-12-08T04:34:38.998353191Z        ---> System.IO.IOException: Cannot determine the frame size or a corrupted frame was received.
2022-12-08T04:34:38.998357491Z          at System.Net.Security.SslStream.GetFrameSize(ReadOnlySpan`1 buffer)
2022-12-08T04:34:38.998361392Z          at System.Net.Security.SslStream.ReceiveBlobAsync[TIOAdapter](TIOAdapter adapter)
2022-12-08T04:34:38.998369092Z          at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
2022-12-08T04:34:38.998374292Z          at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
2022-12-08T04:34:38.998379992Z          --- End of inner exception stack trace ---
2022-12-08T04:34:38.998384192Z          at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
2022-12-08T04:34:38.998388492Z          at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
2022-12-08T04:34:38.998393092Z          at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
2022-12-08T04:34:38.998397292Z          at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(HttpRequestMessage request)
2022-12-08T04:34:38.998401292Z          at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
2022-12-08T04:34:38.998405292Z          at System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
2022-12-08T04:34:38.998410492Z          at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
2022-12-08T04:34:38.998414492Z          at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
2022-12-08T04:34:38.998420392Z          at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
2022-12-08T04:34:38.998424492Z          at Ocelot.Requester.HttpClientHttpRequester.GetResponse(HttpContext httpContext) errors found in ResponderMiddleware. Setting error response for request path:/api/jobs/jobStatus, request method: GET

Ocelot configs

[raman-m]

Hi @harshwd !

Do you use self-signed certificates or SSL certificates of Azure containers?
I want just to make sure...
So, you cannot use development SSL certificates in Azure environment.

[raman-m]

System.Net.Http.HttpConnectionPool.GetHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)

It seems you tried to connect to Azure container which had specific version of HTTP.
Based on your route and log record (see above), I would say that you tried to connect from Ocelot app using HTTP1 version protocol, but possibly your Azure container had another version of HTTP aka HTTP/2+.
To provide correct setting of HTTP version protocol, you need to use DownstreamHttpVersion property of the route.

And, you need more tests...

1. Try to fallback your https scheme to http and check the behavior of the route.
2. If http scheme works perfectly, then you can try to switch to https scheme. But you have to use valid SSL certificates of Azure.
3. For self-signed certificates for testing purposes, we have special DangerousAcceptAnyServerCertificateValidator property of route.