dotnet / dotnet/aspnetcore

Default dev certificate not working with Http3

Open
#41,762 13 comments 0 reactions 0 assignees View on GitHub
area-networking feature-kestrel HTTP3
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

I tried to run the `Http3Sample` but found that the server rejects all the Http3 requests made to it from the browser (Edge Version 101.0.1210.47). However, a simple C# script that I wrote can reach the server over Http/3:
```C#
using System.Net;

var handler = new SocketsHttpHandler();
handler.SslOptions = new System.Net.Security.SslClientAuthenticationOptions
{
RemoteCertificateValidationCallback = (_, __, ___, ____) => true
};

HttpClient client = new HttpClient(handler);
var result = await client.SendAsync(new HttpRequestMessage(HttpMethod.Get, "https://127.0.0.1:5001")
{
Version = HttpVersion.Version30,
VersionPolicy = HttpVersionPolicy.RequestVersionExact
}, CancellationToken.None);

Console.WriteLine(await result.Content.ReadAsStringAsync());
```

I also noticed that if I replace the existing certificate
```C#
var cert = CertificateLoader.LoadFromStoreCert("localhost", StoreName.My.ToString(), StoreLocation.CurrentUser, false);
```
with a newly generated one (see script below), then I can connect to the server via WebTransport APIs in DevTools. The main browser still is refused though.
```C#
var now = DateTimeOffset.UtcNow;
SubjectAlternativeNameBuilder sanBuilder = new();
sanBuilder.AddDnsName("localhost");
using var ec = ECDsa.Create(ECCurve.NamedCurves.nistP256);
CertificateRequest req = new("CN=localhost", ec, HashAlgorithmName.SHA256);
req.CertificateExtensions.Add(new X509EnhancedKeyUsageExtension(new OidCollection
{
new("1.3.6.1.5.5.7.3.1") // serverAuth
}, false));
req.CertificateExtensions.Add(new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, false));
req.CertificateExtensions.Add(sanBuilder.Build());
using var crt = req.CreateSelfSigned(now, now.AddDays(14));
cert = new(crt.Export(X509ContentType.Pfx));
```
The above code snippet was taken from https://github.com/wegylexy/webtransport, which seems to have a WebTransport and http/3 server working in C#.

### Expected Behavior

I should be able to fetch the `Hello, World! Http/3` via the browser. However, I always either get `Hello, World! Http/2` or the browser connection refused message.

### Steps To Reproduce

1. Modify the line 43:
```C#
options.ListenAnyIP(5001, listenOptions =>
```
To become
```C#
options.Listen(IPAddress.Any, 5001, listenOptions =>
```
(This avoids the known bug that prevents the connection)

2. Open a browser and go to `https://localhost:5001`.

_You can also modify the `listenOptions.Protocols` to only include Http/3. In those cases, it always times out instead of just always defaulting to Http/2._

### Exceptions (if any)

_No response_

### .NET Version

_No response_

### Anything else?

Microsoft Visual Studio Enterprise 2022 (64-bit) - Preview
Version 17.3.0 Preview 1.0

**(aspnetcore) PS C:\aspnetcore> dotnet --info**
.NET SDK:
Version: 7.0.100-preview.5.22228.6
Commit: f59d2cfdfe

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22000
OS Platform: Windows
RID: win10-x64
Base Path: C:\aspnetcore\.dotnet\sdk\7.0.100-preview.5.22228.6\

global.json file:
C:\aspnetcore\global.json

Host:
Version: 7.0.0-preview.5.22254.12
Architecture: x64
Commit: 874c6a9375

.NET SDKs installed:
7.0.100-preview.5.22228.6 [C:\aspnetcore\.dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 7.0.0-preview.5.22228.1 [C:\aspnetcore\.dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 7.0.0-preview.5.22226.6 [C:\aspnetcore\.dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.0-preview.5.22254.12 [C:\aspnetcore\.dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 7.0.0-preview.5.22226.7 [C:\aspnetcore\.dotnet\shared\Microsoft.WindowsDesktop.App]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.