[BUG] Cannot connect to APM server which supports only TLSv1.3

[VMelnalksnis]

APM Agent version

1.20.0

Environment

Operating system and version: Ubuntu 20.04.5 LTS

.NET Framework/Core name and version (e.g. .NET 4.6.1, NET Core 3.1.100) : .NET SDK 7.0.102

Application Target Framework(s) (e.g. net461, netcoreapp3.1): net7.0

Describe the bug

After upgrading to 1.20.0 nothing is sent to APM server, because it fails the TLS handshake:

{"log.level":"error","@timestamp":"2023-03-05T11:03:29.598+0200","log.logger":"beater.http","log.origin":{"file.name":"http/server.go","file.line":3195},"message":"http: TLS handshake error from 10.10.12.162:33834: tls: client offered only unsupported versions: [303 302 301]","service.name":"apm-server","ecs.version":"1.6.0"}

To Reproduce

Steps to reproduce the behavior:

1. APM server configuration:

   ssl:
   enabled: true
   certificate: '/path/to/certificate.crt'
   key: '/path/to/key.key'
   key_passphrase: '${KEY_PASSPHRASE}'
   supported_protocols: [TLSv1.3]

2. appsettings.json

       "ElasticApm": {
               "Enabled": true,
               "CentralConfig": false,
               "ServiceName": "Foo",
               "ServerUrl": "https://apm.some.fully.qualified.name.com:8200"
       }

3. Startup.cs

   application.UseElasticApm(
   _configuration,
   new AspNetCoreDiagnosticSubscriber(),
   new HttpDiagnosticsSubscriber(),
   new EfCoreDiagnosticsSubscriber(),
   new ElasticsearchDiagnosticsSubscriber());

After switching supported_protocols: [TLSv1.3] to supported_protocols: [TLSv1.3,TLSv1.2] the connection is established successfully and the APM agent works as expected. I'm guessing this is related to #1926.

Expected behavior

TLSv1.3 works same as it did in 1.19.0

Actual behavior

TLSv1.3 does not work

[kuanpak]

I have the same issue after upgraded Elastic.Apm to 1.20+

[monty241]

A possible solution might be to change in BackendCommUtils.cs from:

#if !NET462
            httpClientHandler.ServerCertificateCustomValidationCallback = serverCertificateCustomValidationCallback;
            logger.Info()?.Log("CreateHttpClientHandler - Setting ServerCertificateCustomValidationCallback");

            httpClientHandler.SslProtocols |= SslProtocols.Tls12;
            logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", httpClientHandler.SslProtocols);
#else
            // We don't set the ServerCertificateCustomValidationCallback on ServicePointManager here as it would
            // apply to the whole AppDomain and that may not be desired. A consumer can set this themselves if they
            // need custom validation behaviour.
            ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12;
            logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", ServicePointManager.SecurityProtocol);
#endif

to something like:

#if NET6_0_OR_GREATER
            httpClientHandler.SslProtocols |= SslProtocols.Tls12;
            httpClientHandler.SslProtocols |= SslProtocols.Tls13;
            logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", httpClientHandler.SslProtocols);
#elif NETFRAMEWORK
            ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12;
            logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", ServicePointManager.SecurityProtocol);
#else
            httpClientHandler.SslProtocols |= SslProtocols.Tls12;
            logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", httpClientHandler.SslProtocols);
#endif

#if !NET462
            httpClientHandler.ServerCertificateCustomValidationCallback = serverCertificateCustomValidationCallback;
            logger.Info()?.Log("CreateHttpClientHandler - Setting ServerCertificateCustomValidationCallback");
#else
            // We don't set the ServerCertificateCustomValidationCallback on ServicePointManager here as it would
            // apply to the whole AppDomain and that may not be desired. A consumer can set this themselves if they
            // need custom validation behaviour.
#endif