dotnet / dotnet/runtime

SocketsHttpHandler.SslOptions.CertificateRevocationCheckMode = X509RevocationMode.Online causes thread starvation

Open
#120,450 4 comments 0 reactions 0 assignees View on GitHub
area-System.Net.Security
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

Per copilot, when set socketsHttpHandler.SslOptions.CertificateRevocationCheckMode = X509RevocationMode.Online, the cert revocation check is a sync operation when create new connections.

In our PROD env, when incoming requests suddenly increases, we can see the duration of requests to do the cert validation range from several seconds to over 20 seconds. The result is, it causes a thread starvation issue. Thread count in thread pool increases a lot. Thousands of outgoing connections are being created and consumes all the memory and CPU resources and causes lots of request timeouts for our API.

### Expected Behavior

Shouldn't the cert validation be done in an async mode for online check?

### Steps To Reproduce

If you want to repro, you can use fiddler to add latency for the cert validation requests and create a small load test.

### Exceptions (if any)

Isn't this a asp.net core built-in sync in async pattern that can potentially cause thread starvation under load?

### .NET Version

.net 9

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.