Error: The SSL connection could not be established, see inner exception. Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host..

[bouncy99]

Please include the following with each issue:

1. Describe the bug With DeveloperServicesSSLEnabled on a business central instance, while using a valid CA issued cert, when publishing to the DeveloperServicesPort of a the business central 21 instance, we are experiencing the error message "Error: The SSL connection could not be established, see inner exception. Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.."

2. To Reproduce Simply publish code to BC21 SSL enabled instance

1. Go to '...'

AL code snippet that demonstrates the issue or a link to a code repository the developers can easily pull down to recreate the issue locally.

Note: Because the developers need to copy and paste the code snippet, including a code snippet as a media file (i.e. .gif) is not sufficient.

3. Expected behavior That the connection would be established, and code published

4. Actual behavior A clear and concise description of what happened accompanied by images, animations, or a link to a video showing the issue occurring

5. Versions:

• AL Language: AL Language extension for Microsoft Dynamics 365 Business Central v12.3.900902
• Visual Studio Code:1.84.2
• Business Central:21.0
• List of Visual Studio Code extensions that you have installed:

Final Checklist

Please remember to do the following:

• [ ] Search the issue repository to ensure you are reporting a new issue

• [ ] Reproduce the issue after disabling all extensions except the AL Language extension

• [ ] Simplify your code around the issue to better isolate the problem

[SBalslev]

We rely on the underlying tools for http requests so not much more info there. However it is clear that there is something wrong with the SSL certificate you have configured or the client you are running this from, I would recommend you check a simple browser request for the metadata yourself on the same machine. And inspect the certificate for validity on the client.

[rdebath]

This looks like the what you get when the Certificate and client are fine but the service tier hasn't been able to install the certificate into the kernel's TLS functions. (But it can also be caused by TLS inspecting firewalls and AV)

You have to reregister the certificate with on server URL and port, this also tends to collide with the urlacl for both HTTP and HTTPS. Changing the port to an unpolluted one will probably work too.

This is an example with cmd shell variables for a SOAP or ODATA port, I don't usually try with the dev port but use the more reliable http over a VPN instead.

netsh http delete urlacl url=http://+:%PORT%/%INST%/
netsh http delete sslcert ipport=0.0.0.0:%PORT%
netsh http delete urlacl url=https://+:%PORT%/%INST%/
netsh http add urlacl url=https://+:%PORT%/%INST% user=%WINUSER%
netsh http add sslcert ipport=0.0.0.0:%PORT% certhash=%CERTTHUMB% appid=%RAND%

[SBalslev]

There is no further action at this point.