search

dotnet / aspnetcore

ASP.NET Core is a cross-platform .NET framework for building modern cloud-based web applications on Windows, Mac, or Linux.
https://asp.net
MIT License
35.38k stars 10k forks source link

MacOS/BlazorServer/HTTPS/.NET7.0: Protocol unsupported, no secure connection, ERR_SSL_VERSION_OR_CIPHER_MISMATCH after changes #46146

Closed SirLefti closed 1 year ago

SirLefti commented 1 year ago

Is there an existing issue for this?

Describe the bug

I am developing a Blazor Server App on MacOS using .NET 7.0, running with HTTPS enabled. I am executing it via dotnet watch for hotreloading in the terminal, so the IDE should not matter. The app works initially fine, but after some changes, when the watch command asks for restarting or alternatively restarting on my own, I get the error message ERR_SSL_VERSION_OR_CIPHER_MISMATCH in Google Chrome Browser or equivalent ones in other browsers.

A valid https certificate is installed via dotnet dev-certs https --trust.

Things I tried out:

Expected Behavior

After restarting, the application should work without issues with the certificate.

Steps To Reproduce

I have been able to reproduce it with a fresh project template, so we can use that here.

  1. Create project with dotnet new blazorserver -n newblazor
  2. Go into that directory and run the project with dotnet watch -lp https (this uses the https launch profile, because the default one is http only)
  3. Open the app in your browser if not done automatically (app should work without an issue here)
  4. Open Pages/Index.razor and make some changes, e.g. add the following at the bottom: 
    <button class="btn btn-primary" onclick="@OnClick">Click me!</button>
@code {
public void OnClick()
{
    Console.WriteLine("Hello from click!");
}
}
  5. Stop the command and restart it again
  6. Reloading the app in the browser should give you an error, that a secure connection could not be established
  7. Stop the command and remove the file ./bin/Debug/net7.0/newblazor
  8. Start again, the app should work now

Other investigations

I tried the same on windows, using only console commands, unable to reproduce the error following the same steps. As already mentioned above, the problematic file is platform-specific.

I also tried it with a fresh blazor wasm app, this works as well so far, unable to reproduce the error following the same step.

Deleting ./bin/Debug/net7.0/newblazor fixes the problem for one time, however when being regenerated, the new file is a true duplicate of the previous deleted one. It seems to be not the file itself to be the problem, but something involved in the process to generate it.

.NET Version

7.0.101

Anything else?

.NET SDK:
 Version:   7.0.101
 Commit:    bb24aafa11

Laufzeitumgebung:
 OS Name:     Mac OS X
 OS Version:  12.6
 OS Platform: Darwin
 RID:         osx.12-x64
 Base Path:   /usr/local/share/dotnet/sdk/7.0.101/

Host:
  Version:      7.0.1
  Architecture: x64
  Commit:       97203d38ba

.NET SDKs installed:
  3.1.402 [/usr/local/share/dotnet/sdk]
  3.1.414 [/usr/local/share/dotnet/sdk]
  3.1.415 [/usr/local/share/dotnet/sdk]
  3.1.416 [/usr/local/share/dotnet/sdk]
  3.1.420 [/usr/local/share/dotnet/sdk]
  3.1.421 [/usr/local/share/dotnet/sdk]
  3.1.422 [/usr/local/share/dotnet/sdk]
  3.1.423 [/usr/local/share/dotnet/sdk]
  3.1.424 [/usr/local/share/dotnet/sdk]
  3.1.425 [/usr/local/share/dotnet/sdk]
  3.1.426 [/usr/local/share/dotnet/sdk]
  5.0.303 [/usr/local/share/dotnet/sdk]
  5.0.402 [/usr/local/share/dotnet/sdk]
  5.0.403 [/usr/local/share/dotnet/sdk]
  5.0.404 [/usr/local/share/dotnet/sdk]
  5.0.408 [/usr/local/share/dotnet/sdk]
  6.0.302 [/usr/local/share/dotnet/sdk]
  6.0.400 [/usr/local/share/dotnet/sdk]
  6.0.401 [/usr/local/share/dotnet/sdk]
  6.0.402 [/usr/local/share/dotnet/sdk]
  6.0.403 [/usr/local/share/dotnet/sdk]
  6.0.404 [/usr/local/share/dotnet/sdk]
  7.0.100 [/usr/local/share/dotnet/sdk]
  7.0.101 [/usr/local/share/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 3.1.8 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.20 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.21 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.22 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.26 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.27 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.28 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.29 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.30 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.31 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.32 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.9 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.11 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.12 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.13 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.17 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.7 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.8 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.9 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.10 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.11 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.12 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 7.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 7.0.1 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.22 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.23 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.8 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.20 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.21 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.22 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.26 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.27 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.28 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.29 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.30 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.31 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.32 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.9 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.11 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.12 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.13 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.17 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.7 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.8 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.9 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.10 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.11 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.12 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 7.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 7.0.1 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
  None

Environment variables:
  Not set

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download

German error message from Google Chrome Browser. Bildschirmfoto 2023-01-18 um 11 59 53

mkArtakMSFT commented 1 year ago

@SirLefti can you check this experience with a different browser and see if that works?

ghost commented 1 year ago

Hi @SirLefti. We have added the "Needs: Author Feedback" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

SirLefti commented 1 year ago

Sure. This is Safari:

Screenshot 2023-01-18 at 18 41 08

Firefox:

Screenshot 2023-01-18 at 18 44 04
surayya-MS commented 1 year ago

Thanks for contacting us @SirLefti . I followed the steps to reproduce the bug and had a slightly different experience. I got the exception on the step 2

Go into that directory and run the project with dotnet watch -lp https (this uses the https launch profile, because the default one is http only)

I also tried it on windows and it works as you said. Could you please try to run the following and tell us if that works?

dotnet dev-certs https --trust
ghost commented 1 year ago

Hi @SirLefti. We have added the "Needs: Author Feedback" label to this issue, which indicates that we have an open question for you before we can take further action. This issue will be closed automatically in 7 days if we do not hear back from you by then - please feel free to re-open it if you come back to this issue after that time.

SirLefti commented 1 year ago

Sorry, what didn't work for you with the dotnet watch -lp https command? What is your error message? The certificate is successfully installed with the dotnet dev-certs https --trust command, which is also mentioned in the first paragraph.

Edit: I am just preparing a short video where I can reproduce the error, maybe that helps.

SirLefti commented 1 year ago

I have made this video on a fairly new machine with latest .net7.0 sdk freshly installed. Certificate has been installed with dotnet dev-certs https --trust. https://youtu.be/K9Ib8Pz9S08

It shows the steps how to create a new project, run it with dotnet watch -lp https, making a little change, restarting and showing the error, deleting the responsible file and restarting it to make it work again.

surayya-MS commented 1 year ago

Sorry, earlier I missed the paragraph where you've mentioned that you installed the certificate. Thanks for providing a video. I followed the exact steps shown in the video and couldn't reproduce the bug. Based on this, I am closing this issue.

SirLefti commented 1 year ago

Interesting. I am trying to sort out if there could be a local config issue.

MelSlavin commented 1 year ago

Hi @SirLefti did you find a fix? I'm facing the same issue.

SirLefti commented 1 year ago

Hey @MelSlavin. It is still an issue for me. I also asked a colleague to try to reproduce the error on his Macs (an Intel one and an Apple Silicon one) but he was unable to reproduce it on any of them. Glad to here I am not the only one anyways.

I am using a 2020 13" Mac Book Pro. What kind of Mac are you using?

clararoman commented 1 year ago

@SirLefti I have the same issue. In a way, glad to see I'm not the only one. Been losing my mind over this. Please let me know if you finally resolve it (I will as well, if I manage to figure it out).

I know the last question wasn't for me, but anyways: I am using a 2021 MacBook Pro (Monterey)

SirLefti commented 1 year ago

@clararoman thank you for your information. I made a test across out team and only my two Macs out of six total Macs were showing the issue. Yesterday a colleague suggested to check the ciphers by the openssl ciphers command. In the output, we swapped the separator with line breaks and then sorted the lines.

Bonus: commands to get ciphers, split and sort them via terminal ```bash openssl ciphers > ciphers ``` ```bash sed -i '' 's/\:/\n/g' ciphers ``` ```bash sort ciphers > ciphers_sorted ```
This is my output ``` AES128-GCM-SHA256 AES128-SHA AES128-SHA256 AES256-GCM-SHA384 AES256-SHA AES256-SHA256 DHE-PSK-AES128-CBC-SHA DHE-PSK-AES128-CBC-SHA256 DHE-PSK-AES128-GCM-SHA256 DHE-PSK-AES256-CBC-SHA DHE-PSK-AES256-CBC-SHA384 DHE-PSK-AES256-GCM-SHA384 DHE-PSK-CHACHA20-POLY1305 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-SHA DHE-RSA-AES256-SHA256 DHE-RSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-PSK-AES128-CBC-SHA ECDHE-PSK-AES128-CBC-SHA256 ECDHE-PSK-AES256-CBC-SHA ECDHE-PSK-AES256-CBC-SHA384 ECDHE-PSK-CHACHA20-POLY1305 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 PSK-AES128-CBC-SHA PSK-AES128-CBC-SHA256 PSK-AES128-GCM-SHA256 PSK-AES256-CBC-SHA PSK-AES256-CBC-SHA384 PSK-AES256-GCM-SHA384 PSK-CHACHA20-POLY1305 RSA-PSK-AES128-CBC-SHA RSA-PSK-AES128-CBC-SHA256 RSA-PSK-AES128-GCM-SHA256 RSA-PSK-AES256-CBC-SHA RSA-PSK-AES256-CBC-SHA384 RSA-PSK-AES256-GCM-SHA384 RSA-PSK-CHACHA20-POLY1305 SRP-AES-128-CBC-SHA SRP-AES-256-CBC-SHA SRP-RSA-AES-128-CBC-SHA SRP-RSA-AES-256-CBC-SHA TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ```
This is from my other affected system ``` AES128-GCM-SHA256 AES128-SHA AES128-SHA256 AES256-GCM-SHA384 AES256-SHA AES256-SHA256 CAMELLIA128-SHA CAMELLIA128-SHA256 CAMELLIA256-SHA CAMELLIA256-SHA256 DES-CBC3-SHA DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-SHA DHE-RSA-AES256-SHA256 DHE-RSA-CAMELLIA128-SHA DHE-RSA-CAMELLIA128-SHA256 DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA256-SHA256 DHE-RSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-DES-CBC3-SHA ECDHE-ECDSA-RC4-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-DES-CBC3-SHA ECDHE-RSA-RC4-SHA EDH-RSA-DES-CBC3-SHA GOST2001-GOST89-GOST89 GOST2012256-GOST89-GOST89 RC4-MD5 RC4-SHA ```
This is from a working system ``` AEAD-AES128-GCM-SHA256 AEAD-AES256-GCM-SHA384 AEAD-CHACHA20-POLY1305-SHA256 AES128-GCM-SHA256 AES128-SHA AES128-SHA256 AES256-GCM-SHA384 AES256-SHA AES256-SHA256 CAMELLIA128-SHA CAMELLIA128-SHA256 CAMELLIA256-SHA CAMELLIA256-SHA256 DES-CBC3-SHA DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-SHA DHE-RSA-AES256-SHA256 DHE-RSA-CAMELLIA128-SHA DHE-RSA-CAMELLIA128-SHA256 DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA256-SHA256 DHE-RSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-DES-CBC3-SHA ECDHE-ECDSA-RC4-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-DES-CBC3-SHA ECDHE-RSA-RC4-SHA EDH-RSA-DES-CBC3-SHA GOST2001-GOST89-GOST89 GOST2012256-GOST89-GOST89 RC4-MD5 RC4-SHA ```

Can you share yours? I compared the results and I spotted that the ciphers AEAD-AES128-GCM-SHA256, AEAD-AES256-GCM-SHA384 and AEAD-CHACHA20-POLY1305-SHA256 are missing in the result of non-working systems. I don't know if that could lead us to the core issue.

When opening my website in a working state and checking the Chrome Dev Tools Security tab, it shows me these details: image

clararoman commented 1 year ago

@SirLefti Thanks for updating! I tried it out and:

This is my output ``` AES128-GCM-SHA256 AES128-SHA AES128-SHA256 AES256-GCM-SHA384 AES256-SHA AES256-SHA256 CAMELLIA128-SHA CAMELLIA128-SHA256 CAMELLIA256-SHA CAMELLIA256-SHA256 DES-CBC3-SHA DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES128-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES256-SHA DHE-RSA-AES256-SHA256 DHE-RSA-CAMELLIA128-SHA DHE-RSA-CAMELLIA128-SHA256 DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA256-SHA256 DHE-RSA-CHACHA20-POLY1305 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-ECDSA-DES-CBC3-SHA ECDHE-ECDSA-RC4-SHA ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES256-SHA384 ECDHE-RSA-CHACHA20-POLY1305 ECDHE-RSA-DES-CBC3-SHA ECDHE-RSA-RC4-SHA EDH-RSA-DES-CBC3-SHA GOST2001-GOST89-GOST89 GOST2012256-GOST89-GOST89 RC4-MD5 RC4-SHA ```

It's almost identical to the output from your "other affected system". When I compare them, the only difference is that:

(So, the same except for the D in the beginning.)

It doesn't really tell me anything, but I'll keep trying to figure it out.

SirLefti commented 1 year ago

I believe it is actually the same and I just made a mistake when splitting the ciphers. I updated my output above including some fancy terminal commands to do the splitting and sorting.

I am trying to collect some more outputs from working systems, but I believe the three mentioned ciphers missing on all affected are already a good guess. The question is, if we can do something about it.

SirLefti commented 1 year ago

I got three identical outputs from working systems. All include AEAD-AES128-GCM-SHA256, AEAD-AES256-GCM-SHA384 and AEAD-CHACHA20-POLY1305-SHA256.

openssl version -a reports LibreSSL 3.3.6 on those working system. My systems report OpenSSL 1.1.1h (first system) and LibreSSL 2.8.3 (second system).

I am now trying to get a more recent version running like via mac ports.

SirLefti commented 1 year ago

Just for your information: I managed to get a 3.x version of LibreSSL via MacPorts, but still running into the same issue (mentioned ciphers seem to be still missing). As of writing this, I do not have any further ideas to track down.