ClickHouse / ClickHouse/ClickHouse.EntityFrameworkCore
SkipServerCertificateValidation doesn't seem to work when passing a DbConnection or DbDataSource to UseClickHouse
- Dominant language
- C#
- Stars
- 23
- Forks
- 7
- Avg merge
- 14d 3h
- Merged PRs (30d)
- 1
Description
## Description
I'm trying to connect to a ClickHouse instance with an untrusted/self-signed cert, and skip validation using `ClickHouseClientSettings.SkipServerCertificateValidation`. Since that setting doesn't exist as a connection string key, I'm building a `ClickHouseClientSettings` object in code and passing it into either a `ClickHouseConnection` or `ClickHouseDataSource`, then handing that to `UseClickHouse` from EntityFrameworkCore.
Both the `DbConnection` overload and the `DbDataSource` overload fail with an untrusted root / SSL error, exactly as if the setting were never set.
To rule out the driver itself, I tested the same settings object directly with `ClickHouseClient` (no EF Core at all) and it works fine, connects and runs a query with no cert error. So the setting itself works, it just doesn't seem to carry through when going through either of these two `UseClickHouse` overloads.
My guess is that somewhere internally it's pulling the connection string back out of the connection/data source and building a new one from that, which would explain why a setting that only exists in code (not in the connection string) gets lost.
## Repro
Works fine, no EF Core:
```csharp
var settings = new ClickHouseClientSettings("Host=;Protocol=https;Port=8443;Username=;Password=")
{
SkipServerCertificateValidation = true
};
using var client = new ClickHouseClient(settings);
await client.ExecuteScalarAsync("SELECT 1"); // succeeds
```
Fails with DbDataSource:
```csharp
var dataSource = new ClickHouseDataSource(settings);
var options = new DbContextOptionsBuilder()
.UseClickHouse(dataSource)
.Options;
await using var ctx = new MyContext(options);
await ctx.Database.CanConnectAsync(); // untrusted root error
```
Fails with DbConnection too:
```csharp
var connection = new ClickHouseConnection(settings);
var options = new DbContextOptionsBuilder()
.UseClickHouse(connection, contextOwnsConnection: true)
.Options;
await using var ctx = new MyContext(options);
await ctx.Database.CanConnectAsync(); // same error
```
## Exception
`System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot at System.Net.Security.SslStream.CompleteHandshake...`
## Environment
- ClickHouse.EntityFrameworkCore: 0.2.0
- ClickHouse.Driver: 1.1.0
- .NET: 10.0
## Question
Is `UseClickHouse(DbConnection)` / `UseClickHouse(DbDataSource)` expected to preserve the actual instance you pass in, including settings that don't have a connection string equivalent? Right now it looks like it's only picking up whatever survives a round trip through the connection string, which silently drops anything like `SkipServerCertificateValidation` that's code-only.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the UseClickHouse(DbConnection) and UseClickHouse(DbDataSource) overloads and compare their handling with the direct ClickHouseClient repro. Verify whether the supplied connection or data source, including SkipServerCertificateValidation, is preserved; the fix is complete when both EF Core overloads allow CanConnectAsync to succeed with the self-signed certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100