Open VMelnalksnis opened 1 year ago
I have the same issue after upgraded Elastic.Apm to 1.20+
A possible solution might be to change in BackendCommUtils.cs from:
#if !NET462
httpClientHandler.ServerCertificateCustomValidationCallback = serverCertificateCustomValidationCallback;
logger.Info()?.Log("CreateHttpClientHandler - Setting ServerCertificateCustomValidationCallback");
httpClientHandler.SslProtocols |= SslProtocols.Tls12;
logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", httpClientHandler.SslProtocols);
#else
// We don't set the ServerCertificateCustomValidationCallback on ServicePointManager here as it would
// apply to the whole AppDomain and that may not be desired. A consumer can set this themselves if they
// need custom validation behaviour.
ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12;
logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", ServicePointManager.SecurityProtocol);
#endif
to something like:
#if NET6_0_OR_GREATER
httpClientHandler.SslProtocols |= SslProtocols.Tls12;
httpClientHandler.SslProtocols |= SslProtocols.Tls13;
logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", httpClientHandler.SslProtocols);
#elif NETFRAMEWORK
ServicePointManager.SecurityProtocol |= SecurityProtocolType.Tls12;
logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", ServicePointManager.SecurityProtocol);
#else
httpClientHandler.SslProtocols |= SslProtocols.Tls12;
logger.Info()?.Log("CreateHttpClientHandler - SslProtocols: {SslProtocols}", httpClientHandler.SslProtocols);
#endif
#if !NET462
httpClientHandler.ServerCertificateCustomValidationCallback = serverCertificateCustomValidationCallback;
logger.Info()?.Log("CreateHttpClientHandler - Setting ServerCertificateCustomValidationCallback");
#else
// We don't set the ServerCertificateCustomValidationCallback on ServicePointManager here as it would
// apply to the whole AppDomain and that may not be desired. A consumer can set this themselves if they
// need custom validation behaviour.
#endif
APM Agent version
1.20.0
Environment
Operating system and version: Ubuntu 20.04.5 LTS
.NET Framework/Core name and version (e.g. .NET 4.6.1, NET Core 3.1.100) : .NET SDK 7.0.102
Application Target Framework(s) (e.g. net461, netcoreapp3.1): net7.0
Describe the bug
After upgrading to 1.20.0 nothing is sent to APM server, because it fails the TLS handshake:
To Reproduce
Steps to reproduce the behavior:
appsettings.json
Startup.cs
After switching
supported_protocols: [TLSv1.3]
tosupported_protocols: [TLSv1.3,TLSv1.2]
the connection is established successfully and the APM agent works as expected. I'm guessing this is related to #1926.Expected behavior
TLSv1.3 works same as it did in 1.19.0
Actual behavior
TLSv1.3 does not work