HTTPS defaults need to be set before Listen()

[gitforanand]

Describe the bug

When set to use Certificate Authentication with Kestrel receive 403 forbidden. Negotiation complete but forbidden.

To Reproduce

Dotnet core api basic with certificate authenitcation enabled.
Curl insecure with SSL fails

Exceptions (if any)

Further technical details

• ASP.NET Core version
• The IDE VS4Mac

.NET Core SDK (reflecting any global.json):
Version: 3.1.402
Commit: 9b5de826fd

Runtime Environment:
OS Name: Mac OS X
OS Version: 10.15
OS Platform: Darwin
RID: osx.10.15-x64
Base Path: /usr/local/share/dotnet/sdk/3.1.402/

Host (useful for support):
Version: 3.1.8
Commit: 9c1330dedd

.NET Core SDKs installed:
2.1.202 [/usr/local/share/dotnet/sdk]
2.1.810 [/usr/local/share/dotnet/sdk]
3.1.102 [/usr/local/share/dotnet/sdk]
3.1.302 [/usr/local/share/dotnet/sdk]
3.1.401 [/usr/local/share/dotnet/sdk]
3.1.402 [/usr/local/share/dotnet/sdk]

.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.1.22 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.22 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.2 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.6 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.7 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 3.1.8 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 2.0.9 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.16 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.20 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.21 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.22 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 2.2.8 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.2 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.6 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.7 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.8 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

To install additional .NET Core runtimes or SDKs:
https://aka.ms/dotnet-download

[Tratcher]

ALPN, server did not agree to a protocol

What does the title have to do with the rest of your issue? It seems unrelated.

The 403 means the client certificate didn't meet the requirements. Enable server logs to get additional details.

[gitforanand]

I tired similar approach https://devblogs.microsoft.com/aspnet/asp-net-core-2-2-0-preview1-http-2-in-kestrel/

[gitforanand]

This one too https://docs.microsoft.com/en-us/aspnet/core/grpc/troubleshoot?view=aspnetcore-3.1

[Tratcher]

Start here: https://docs.microsoft.com/en-us/aspnet/core/fundamentals/logging/?view=aspnetcore-3.1#configure-logging

[gitforanand]

@Tratcher, I understand logging. I followed this https://docs.microsoft.com/en-us/aspnet/core/security/authentication/certauth?view=aspnetcore-3.1.
Result

Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request starting HTTP/1.1 GET https://dev.cybertune.local:6443/api/v1/health
Loaded 'Anonymously Hosted DynamicMethods Assembly'.
Microsoft.AspNetCore.Authorization.DefaultAuthorizationService: Information: Authorization failed.
Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler: Information: AuthenticationScheme: Certificate was challenged.
Loaded '/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App/3.1.8/Microsoft.AspNetCore.WebUtilities.dll'. Skipped loading symbols. Module is optimized and the debugger option 'Just My Code' is enabled.
Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request finished in 131.9157ms 403 .

[Tratcher]

There's no indication there was a client certificate on that request. How did you configure Kestrel?

[gitforanand]

curl --insecure --ssl --tlsv1.2 -v --key dev.cybertune.local.key --cert dev.cybertune.local.crt https://dev.cybertune.local:6443/api/v1/health

• Trying ::1...
• TCP_NODELAY set
• Connection failed
• connect to ::1 port 6443 failed: Connection refused
• Trying ::1...
• TCP_NODELAY set
• Connection failed
• connect to ::1 port 6443 failed: Connection refused
• Trying 127.0.0.1...
• TCP_NODELAY set
• Connected to dev.cybertune.local (127.0.0.1) port 6443 (#0)
• ALPN, offering h2
• ALPN, offering http/1.1
• successfully set certificate verify locations:
• CAfile: /etc/ssl/cert.pem
  CApath: none
• TLSv1.2 (OUT), TLS handshake, Client hello (1):
• TLSv1.2 (IN), TLS handshake, Server hello (2):
• TLSv1.2 (IN), TLS handshake, Certificate (11):
• TLSv1.2 (IN), TLS handshake, Server key exchange (12):
• TLSv1.2 (IN), TLS handshake, Server finished (14):
• TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
• TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
• TLSv1.2 (OUT), TLS handshake, Finished (20):
• TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
• TLSv1.2 (IN), TLS handshake, Finished (20):
• SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
• ALPN, server did not agree to a protocol
• Server certificate:
• subject: C=US; ST=VA; L=ASHBURN; O=Cybertune Local; OU=Information Technology; CN=dev.cybertune.local; emailAddress=admin@cybertune.local
• start date: Sep 21 02:57:14 2020 GMT
• expire date: Dec 25 02:57:14 2022 GMT
• issuer: C=US; ST=VA; L=ASHBURN; O=cybertune.local; OU=Information Technology; CN=Cybertune Local; emailAddress=admin@cybertune.org
• SSL certificate verify ok.

GET /api/v1/health HTTP/1.1
Host: dev.cybertune.local:6443
User-Agent: curl/7.64.1
Accept: /

< HTTP/1.1 403 Forbidden
< Date: Thu, 24 Sep 2020 14:38:44 GMT
< Server: Kestrel
< Content-Length: 0
<

• Connection #0 to host dev.cybertune.local left intact
• Closing connection 0

LOGS:

Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request starting HTTP/1.1 GET https://dev.cybertune.local:6443/api/v1/health
Microsoft.AspNetCore.Authorization.DefaultAuthorizationService: Information: Authorization failed.
Microsoft.AspNetCore.Authentication.Certificate.CertificateAuthenticationHandler: Information: AuthenticationScheme: Certificate was challenged.
Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request finished in 34.3418ms 403

KESTREL

    public static IHostBuilder CreateHostBuilder(string[] args) =>
        Host.CreateDefaultBuilder(args)
            .ConfigureWebHostDefaults(webBuilder =>
            {
                webBuilder.ConfigureKestrel(serverOptions =>
                {

                    serverOptions.Listen(IPAddress.Loopback, 6443, liOpt =>
                    {
                        liOpt.Protocols = Microsoft.AspNetCore.Server.Kestrel.Core.HttpProtocols.Http1AndHttp2;
                        liOpt.UseHttps("dev.cybertune.local.pfx", "XXXREDACTED");
                    });

                    serverOptions.ConfigureHttpsDefaults(httpOpts => { httpOpts.ClientCertificateMode = ClientCertificateMode.RequireCertificate; });
                })
                .
                UseStartup<Startup>();
               

            });

[gitforanand]

[Tratcher]

@halter73 wasn't there an ordering issue if you called ConfigureHttpsDefaults after Listen?

aspnetcore/src/Servers/Kestrel/Core/src/ListenOptionsHttpsExtensions.cs

Lines 182 to 183 in 4dfa2c7

	listenOptions.KestrelServerOptions.ApplyHttpsDefaults(options);
	configureOptions(options);

[halter73]

I think that's exactly it. You need to call ConfigureHttpsDefaults before Listen.

It's something we can look at improving. Lazily evaluating Listen callback might be the way to go, but it would break applications that depend on the side effects of the callback immediately after calling Listen immediately. Applying defaults to already-configured endpoints risks overriding options we shouldn't, and delaying the execution of the UseHttps callback has similar problems as delaying the execution of the Listen callback.