Kestrel on linux logs a first chance exception with every EC2 health check request
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
on linux we see a first chance exception with every ~~https~~ health test request from ec2
### Expected Behavior
the health check requests do not cause exceptions. it looks like the amount of exceptions is causing increased GC heap size and increased CPU and process memory usage.
### Steps To Reproduce
a simple webapp that logs first chance exceptions, eg:
```c#
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSystemd();
builder.Services.AddWindowsService();
builder.WebHost.ConfigureKestrel(
kso => kso.ConfigureHttpsDefaults(
o => o.ServerCertificate = my_ssl_cert))
.UseUrls("https://+:443");
AppDomain.CurrentDomain.FirstChanceException += (o, e) =>
logger.Warning(e.Exception, e.Exception.Message);
builder.Build().Run();
```
deploy as systemd service, eg:
```pwsh
if (!(gcm dotnet -ea silent) -or !(dotnet --list-runtimes | grep 'AspNetCore.App 9.0')) {
curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 9.0 --runtime aspnetcore --install-dir /usr/lib64/dotnet
if (!(gcm dotnet -ea silent)) { ln -s /usr/lib64/dotnet/dotnet /usr/bin/dotnet -f }
}
New-Item -Force -Path /etc/systemd/system/test-site.service -ItemType file -Value @"
[Unit]
Description=Test Site
[Service]
WorkingDirectory=/path/to/site
ExecStart=/usr/bin/dotnet TestSite.dll
Restart=always
[Install]
WantedBy=multi-user.target
"@
systemctl daemon-reload
systemctl restart test-site
systemctl enable test-site
```
add the instance to a TLS target group in EC2, the http requests from the health checks trigger these exceptions several times a second.
### Exceptions (if any)
```
System.IO.IOException: Received an unexpected EOF or 0 bytes from the transport stream.
at System.Net.Security.SslStream.ReceiveHandshakeFrameAsync[TIOAdapter](CancellationToken cancellationToken)
at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
at Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware.OnConnectionAsync(ConnectionContext context)
```
### .NET Version
9.0.3
### Anything else?
the environment is AWS EC2, we've tested with Amazon Linux 2023 and Ubuntu 24.04, and every version of dotnet from 8.0.0 to 9.0.3
the exceptions don't appear on Windows (tested server 2022 and 2025)
output from `dotnet --info`:
```
Host:
Version: 9.0.3
Architecture: arm64
Commit: 831d23e561
RID: linux-arm64
.NET SDKs installed:
No SDKs were found.
.NET runtimes installed:
Microsoft.AspNetCore.App 9.0.3 [/usr/lib64/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 9.0.3 [/usr/lib64/dotnet/shared/Microsoft.NETCore.App]
```
Contributor guide
Assessment
This issue has not been assessed yet.