Azure / Azure/azure-functions-core-tools

Upgrading from 4.0.3971 to 4.0.4704 causes SSL certs to not be served when running locally (Mac)

Open
#3,125 2 comments 1 reaction 0 assignees View on GitHub
investigate
Dominant language
C#
Stars
1.5k
Forks
498
Avg merge
5d 4h
Merged PRs (30d)
15

Description

I'm on Mac.

I have 2 machines and I upgraded core tools on one of those machines and SSL certs stopped being served up.

Running my function app using the following used to serve up web requests using SSL just fine.
```
func start --useHttps --cert ./ssl/localhost/development.pfx --password --verbose
```

Once I upgraded from 4.0.3971 to 4.0.4704 it broke. I confirmed this using a separate Mac as well.

Requesting cert from function app (for me: localhost:7071)

![image](https://user-images.githubusercontent.com/8148174/184912574-a20066ab-5fea-49e5-8d4a-0a57be9f306b.png)

Requesting cert from another local HTTP server terminated by TLS (for me: localhost:3000) - this is just to prove that this process of cert discovery works using Mac's Keychain app with a known good.

![image](https://user-images.githubusercontent.com/8148174/184912997-4c896153-1f33-493b-b8f6-a6ee80956642.png)

See compare of 4.0.3971 to 4.0.4704 - not sure where the regression is:
https://github.com/Azure/azure-functions-core-tools/compare/4.0.3971...4.0.4704

From Chrome (just visiting a URL directly)
image

From Postman:
![image](https://user-images.githubusercontent.com/8148174/184913851-c5fa3e3d-9ba8-48dd-b612-a10a8596ee9e.png)

From cURL:
![image](https://user-images.githubusercontent.com/8148174/184913973-90563f0b-898e-450f-b692-42d38be09e35.png)

From openssl:
![image](https://user-images.githubusercontent.com/8148174/184914077-b7a871ef-1f3b-43e5-b082-6a53af5163c7.png)

From wireshark (You'll notice the Fatal error 70 on the TLS request that should've been the server hello of the TLS handshake:
image

Anyone have any ideas on what has broken SSL termination when running from localhost on Mac? ~~I have not been able to roll back Azure Function Core Tools to a previous version using Homebrew so I'm basically prevented from doing any development right now because we rely on TLS working in our local dev environments.~~ See post below for what I did to temporarily roll back using Homebrew and restore SSL functionality.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with `func start --useHttps --cert ./ssl/localhost/development.pfx --password --verbose` on macOS, comparing Core Tools 4.0.3971 and 4.0.4704. Review the linked version diff and the TLS output from Chrome, Postman, cURL, openssl, and Wireshark. Done means the local Function app serves the supplied certificate and completes the TLS handshake again.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.