HttpClient not sending certificate setup in handler

Open
#109,050 12 comments 1 reaction 1 assignee View on GitHub

@krwq is already working on this.

Since Feb 9, 2025.

Assessment

This issue has not been assessed yet.

Description

area-System.Security regression-from-last-release
Description

When going from .Net 8 to .Net 9 and setting up a Named HttpClient for DI with a handler the certificate is never sent. Verified the certificate is never sent by using WireShark to intercept the network communications.

Reproduction Steps

.Net 8

services.AddHttpClient("NamedClient",
        client => { client.BaseAddress = new Uri("serverUrl"); })
    .ConfigurePrimaryHttpMessageHandler(() =>
        {
            var handler = new HttpClientHandler
            {
                ClientCertificateOptions = ClientCertificateOption.Manual
            };
 
            var certs = new X509Certificate2(
                configuration.GetValue<string>("CertPath")!,
                configuration.GetValue<string>("CertPassword")!, X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.MachineKeySet);
            handler.ClientCertificates.Add(certs);
            return handler;
        }
    )

.Net 9, Also tired with the same Obsolete code using new X509Certificate2 with the same result.

services.AddHttpClient("NamedClient",
        client => { client.BaseAddress = new Uri("serverUrl"); })
    .ConfigurePrimaryHttpMessageHandler(() =>
        {
            var handler = new HttpClientHandler
            {
                ClientCertificateOptions = ClientCertificateOption.Manual
            };
 
            var certs =X509CertificateLoader.LoadPkcs12FromFile(
                configuration.GetValue<string>("CertPath")!,
                configuration.GetValue<string>("CertPassword")!, X509KeyStorageFlags.PersistKeySet | X509KeyStorageFlags.MachineKeySet);
            handler.ClientCertificates.Add(certs);
            return handler;
        }
    )
Expected behavior

Certificate is sent during handshake.

Image

Actual behavior

No certificate sent

Image

Regression?

Worked as Expected .Net 8

Known Workarounds

No response

Configuration

.Net 9 RC2
Windows 11 x64

Other information

No response

Dominant language
C#
Stars
18.3k
Forks
5.6k
PR metrics pending

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dotnet/runtime

All issues in dotnet/runtime

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.