Azure / Azure/azure-functions-core-tools
Upgrading from 4.0.3971 to 4.0.4704 causes SSL certs to not be served when running locally (Mac)
- Dominant language
- C#
- Stars
- 1.5k
- Forks
- 498
- Avg merge
- 5d 4h
- Merged PRs (30d)
- 15
Description
I'm on Mac.
I have 2 machines and I upgraded core tools on one of those machines and SSL certs stopped being served up.
Running my function app using the following used to serve up web requests using SSL just fine.
```
func start --useHttps --cert ./ssl/localhost/development.pfx --password --verbose
```
Once I upgraded from 4.0.3971 to 4.0.4704 it broke. I confirmed this using a separate Mac as well.
Requesting cert from function app (for me: localhost:7071)

Requesting cert from another local HTTP server terminated by TLS (for me: localhost:3000) - this is just to prove that this process of cert discovery works using Mac's Keychain app with a known good.

See compare of 4.0.3971 to 4.0.4704 - not sure where the regression is:
https://github.com/Azure/azure-functions-core-tools/compare/4.0.3971...4.0.4704
From Chrome (just visiting a URL directly)

From Postman:

From cURL:

From openssl:

From wireshark (You'll notice the Fatal error 70 on the TLS request that should've been the server hello of the TLS handshake:

Anyone have any ideas on what has broken SSL termination when running from localhost on Mac? ~~I have not been able to roll back Azure Function Core Tools to a previous version using Homebrew so I'm basically prevented from doing any development right now because we rely on TLS working in our local dev environments.~~ See post below for what I did to temporarily roll back using Homebrew and restore SSL functionality.
Contributor guide
Research direction
Start by reproducing the issue with `func start --useHttps --cert ./ssl/localhost/development.pfx --password --verbose` on macOS, comparing Core Tools 4.0.3971 and 4.0.4704. Review the linked version diff and the TLS output from Chrome, Postman, cURL, openssl, and Wireshark. Done means the local Function app serves the supplied certificate and completes the TLS handshake again.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100