You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Self-hosted gateway (docker) fails to forward requests to the backend with SSL handshake error.
Backend like https://www.cargosmart.com is using TLS_RSA_WITH_AES_128_CBC_SHA256. When I request an API which forwards requests to the backend, the gateway will return HTTP 500 with the message "Internal server error". Even though I provided TLS_RSA_WITH_AES_128_CBC_SHA256 in net.client.tls.ciphers.allowed-suites, it still error.
Checked with dotnet SDK document, it should due to the container .NET doesn't include any cipher suites that are compatible with TLS 1.0 or TLS 1.1, these older protocol versions are effectively disabled by default.
I executed bash in the container and created an openssl.sec1.cnf with below content and export OPENSSL_CONF=/app/openssl.sec1.cnf according to dotnet/runtime#44191 (comment), it works now.
Report
Self-hosted gateway (docker) fails to forward requests to the backend with SSL handshake error.
Backend like https://www.cargosmart.com is using TLS_RSA_WITH_AES_128_CBC_SHA256. When I request an API which forwards requests to the backend, the gateway will return HTTP 500 with the message "Internal server error". Even though I provided
TLS_RSA_WITH_AES_128_CBC_SHA256
innet.client.tls.ciphers.allowed-suites
, it still error.Checked with dotnet SDK document, it should due to the container .NET doesn't include any cipher suites that are compatible with TLS 1.0 or TLS 1.1, these older protocol versions are effectively disabled by default.
I executed bash in the container and created an openssl.sec1.cnf with below content and
export OPENSSL_CONF=/app/openssl.sec1.cnf
according to dotnet/runtime#44191 (comment), it works now.Expected Behavior
Returns HTTP 200 with proper payload
Actual Behavior
Returns HTTP 500 with below payload
Steps to Reproduce the Problem
Logs from self-hosted gateway
Self-hosted Gateway Version
v2
Deployment
Docker (Compose)
Platform
None
Kubernetes Version
None
Anything else?
https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview#available-cipher-suites is contradict with https://learn.microsoft.com/en-us/dotnet/core/compatibility/cryptography/5.0/default-cipher-suites-for-tls-on-linux
The text was updated successfully, but these errors were encountered: