httpsgrpc.net-5

Certificate error invoking gRPC service with HTTPS under .Net 5: UntrustedRoot

I am trying to HTTPS connect my gRPC client and service, both running under .Net 5 on my local Windows 10 machine. Now I am getting this certificate error and not sure how to fix it:

    Status(StatusCode=\"Internal\", Detail=\"Error starting gRPC call. 
    HttpRequestException: The SSL connection could not be established, see inner exception. 
    
    AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot\", DebugException=\"System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.\r\n 
---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot\r\n   at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception)\r\n   at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)\r\n   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Boolean async, Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)\r\n   --- End of inner exception stack trace ---\r\n   at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Boolean async, Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpConnectionPool.GetHttp2ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)\r\n   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)\r\n   at Grpc.Net.Client.Internal.GrpcCall`2.RunCall(HttpRequestMessage request, Nullable`1 timeout)\")

I tried to install a dev certificate by running the commend below, but it seems one have already exist:

enter image description here

And it appears that I have this cert under both of my Personal and Trusted Root stores

enter image description here

enter image description here

I do noticed however, that the cert exists in my stores is "IIS Express Development Certificate", instead of "ASP.NET Core HTTPS development certificate". Dose that matter? If so, how do I get the correct cert installed? If not, what else am I missing?

Solution

  • In case anyone interested - in my case, this was caused by the fact that gRPC hosting is not supported by IIS under my current build level of Windows. While I was waiting for MS to complete a solution, I just added the following to my gRPC client side:

        var httpHandler = new HttpClientHandler();
    httpHandler.ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;
    var channel = GrpcChannel.ForAddress(ServerAddress, new GrpcChannelOptions { HttpHandler = httpHandler });

    As you can see, this code is TEMPORARY and not meant for production. Microsoft has recently said that the support has been included in the operation system's build 20241 or later, which I am planning to test in the coming weeks.