0

I have configured a X509 Certificate using RestSharp on a C# Web application running on .NET Core 3.1. I am able to receive a 200 on all endpoints when on Development, however when published on IIS. The system is unresponsive.

Any guide on where I may be going wrong?

This is a sample of the code in question:

        var restClient = new RestClient("");

        ServicePointManager.Expect100Continue = true;
        ServicePointManager.DefaultConnectionLimit = 9999;
        ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;
        ServicePointManager.ServerCertificateValidationCallback += (s, cert, chain, sslPolicyErrors) => true;

        X509Certificate2 certificate = new X509Certificate2(@"C:\Users\xx\xxx.pfx", "");
        restClient.ClientCertificates = new X509CertificateCollection() { certificate };
        restClient.Proxy = new WebProxy();

        var request = new RestRequest(Method.POST);
        request.AddHeader("Cache-Control", "no-cache");
        request.AddHeader("Accept", "application/json");
        request.AddHeader("Content-Type", "application/json; charset=utf-8");

        request.Parameters.Clear();
        request.AddHeader("Authorization", string.Format("Bearer {0}", Get()));
        request.AddHeader("ClientID", "443E8BE7-3844-4555-898D-93F728B0BD50");
        request.AddParameter("mystuff", ParameterType.RequestBody);

I am testing my endpoints using Swagger

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
Nickson
  • 135
  • 12
  • 1
    Are you doing many concurrent client requests? If yes, locking of the cert file can be an issue, reach client trying to open the very same file. Instead, make it a singleton so that you read once without possible locking. – Wiktor Zychla May 10 '22 at 17:11
  • @WiktorZychla The Requests are not concurrent. – Nickson May 10 '22 at 17:17
  • 1
    Your code is unsafe. You're re-enabling unsafe TLS protocols while preventing the use of new protocols like TLS 1.3. Don't do that. .NET Core will use the most secure algorithm available by the OS by default – Panagiotis Kanavos May 10 '22 at 17:19
  • When you say the system is "unresponsive", what does that mean, exactly? Is it just hanging? Do you get a response at all? Does it time out? – JuanR May 10 '22 at 17:20
  • @JuanR I am receiving a 404 on the same endpoint on production – Nickson May 10 '22 at 17:38
  • @Nickson 404 != unresponsive. Two very different things. – JuanR May 10 '22 at 17:41
  • Just a wild though. Might it be that IIS is not recognizing the client certificates? – Nickson May 10 '22 at 17:42
  • @Nickson Are you sure you are hitting the right endpoint? (with the right protocol and port?) – JuanR May 10 '22 at 17:44
  • @JuanR Yes. I am using Swagger API to test endpoints on both environments – Nickson May 10 '22 at 17:47
  • @Nickson when you say you are using Swagger API to test endpoints, what exactly are you doing? Are you using Swagger Inspector? – JuanR May 10 '22 at 17:50
  • Let us [continue this discussion in chat](https://chat.stackoverflow.com/rooms/244647/discussion-between-nickson-and-juanr). – Nickson May 10 '22 at 17:56
  • Could you possibly improve your question to clarify what exact symptoms are? I also believe that 404 and unresponsive are not synonyms. Which basically mean that you give important details in comments under the question – Wiktor Zychla May 10 '22 at 19:05

0 Answers0