dotnet / dotnet/aspnetcore

Kestrel on linux logs a first chance exception with every EC2 health check request

Open
#61,081 4 comments 0 reactions 0 assignees View on GitHub
area-networking
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

on linux we see a first chance exception with every ~~https~~ health test request from ec2

### Expected Behavior

the health check requests do not cause exceptions. it looks like the amount of exceptions is causing increased GC heap size and increased CPU and process memory usage.

### Steps To Reproduce

a simple webapp that logs first chance exceptions, eg:
```c#
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSystemd();
builder.Services.AddWindowsService();
builder.WebHost.ConfigureKestrel(
kso => kso.ConfigureHttpsDefaults(
o => o.ServerCertificate = my_ssl_cert))
.UseUrls("https://+:443");

AppDomain.CurrentDomain.FirstChanceException += (o, e) =>
logger.Warning(e.Exception, e.Exception.Message);

builder.Build().Run();
```
deploy as systemd service, eg:
```pwsh
if (!(gcm dotnet -ea silent) -or !(dotnet --list-runtimes | grep 'AspNetCore.App 9.0')) {
curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin --channel 9.0 --runtime aspnetcore --install-dir /usr/lib64/dotnet
if (!(gcm dotnet -ea silent)) { ln -s /usr/lib64/dotnet/dotnet /usr/bin/dotnet -f }
}

New-Item -Force -Path /etc/systemd/system/test-site.service -ItemType file -Value @"
[Unit]
Description=Test Site

[Service]
WorkingDirectory=/path/to/site
ExecStart=/usr/bin/dotnet TestSite.dll
Restart=always

[Install]
WantedBy=multi-user.target
"@

systemctl daemon-reload
systemctl restart test-site
systemctl enable test-site
```

add the instance to a TLS target group in EC2, the http requests from the health checks trigger these exceptions several times a second.

### Exceptions (if any)

```
System.IO.IOException: Received an unexpected EOF or 0 bytes from the transport stream.
at System.Net.Security.SslStream.ReceiveHandshakeFrameAsync[TIOAdapter](CancellationToken cancellationToken)
at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
at Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware.OnConnectionAsync(ConnectionContext context)
```

### .NET Version

9.0.3

### Anything else?

the environment is AWS EC2, we've tested with Amazon Linux 2023 and Ubuntu 24.04, and every version of dotnet from 8.0.0 to 9.0.3

the exceptions don't appear on Windows (tested server 2022 and 2025)

output from `dotnet --info`:

```
Host:
Version: 9.0.3
Architecture: arm64
Commit: 831d23e561
RID: linux-arm64

.NET SDKs installed:
No SDKs were found.

.NET runtimes installed:
Microsoft.AspNetCore.App 9.0.3 [/usr/lib64/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 9.0.3 [/usr/lib64/dotnet/shared/Microsoft.NETCore.App]
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.