Azure Key Vault Managed Identities SSL connection could not be established

Question

Hi,

I have two Azure App Service running in Window Container Plan which push from ACR using User Managed Identity with Reader role for accessing Azure key Vault.
The first app is working fine, but the second is not working. They have the exactly same code as below which using .Net Core 3.1:

After deploying the second App Service, I keep getting following error:

02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] - Unhandled exception. System.AggregateException: Retry failed after 4 tries. Retry settings can be adjusted in ClientOptions.Retry. (The SSL connection could not be established, see inner exception.) (The SSL connection could not be established, see inner exception.) (The SSL connection could not be established, see inner exception.) (The SSL connection could not be established, see inner exception.)  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -  ---> Azure.RequestFailedException: The SSL connection could not be established, see inner exception.  
02/06/2022 09:26:26.115 WARNING - Site: sea-app-uat-dcoadmin-01 - Container producing too many logs. Suspending temporarily.  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -  ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -  ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream.  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -    at System.Net.Security.SslStream.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -    at System.Net.Security.SslStream.PartialFrameCallback(AsyncProtocolRequest asyncRequest)  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] - --- End of stack trace from previous location where exception was thrown ---  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -    at System.Net.Security.SslStream.ThrowIfExceptional()  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -    at System.Net.Security.SslStream.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -    at System.Net.Security.SslStream.EndProcessAuthentication(IAsyncResult result)  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -    at System.Net.Security.SslStream.EndAuthenticateAsClient(IAsyncResult asyncResult)  
02/06/2022 09:26:26.115 STDERR - Site: sea-app-uat-dcoadmin-01 - [7ae78f9bc29451e8029f9caa7861ee2aa55aadba6fffa529a5f25dbd8f67d658] -    at System.Net.Security.SslStream.<>c.

Answer 1

Hi @ronkit

The problem is when the program is released and restarted. So please use the diagnostic tool to check your App Service.

You will find some useful information, if you need further help, please let me know.

Best Regards,
Jason

Answer 2

@ronkit
Thank you for following up on this!

Based off the warnings and STDERR's within your logs, it doesn't look like this is directly an issue with the managed identity or Key Vault. However, this could be more related to the SSL connection as I mentioned earlier, so I've added the .NET community support tags to this thread so their experts can look into this issue as well.

• Because you have two apps with the same config, and the first app is working as expected, do you know if the second app has any networking config that could be causing this issue?
• Is the second app sharing the same resources (i.e. KV)?

Potential Issues:

 02/06/2022 09:26:26.115 WARNING - Site: sea... - Container producing too many logs. Suspending temporarily.  
 02/06/2022 09:26:26.115 STDERR - Site: sea... - [7ae...] -  ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.  
 02/06/2022 09:26:26.115 STDERR - Site: sea... - [7ae...] -  ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream.  

When it comes the SSL messages, I found a few Stack Overflow threads that might help point you in the right direction.

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception:

• The SSL connection could not be established - From some of the solutions provided, you might be running into an issue where your app needs to trust the SSL certificate of the localhost.
• SSL in Asp.Net Core doesn't work - This issue can also occur if your application isn't enabled for SSL

System.IO.IOException: Authentication failed because the remote party has closed the transport stream:

• System.IO.IOException: Authentication failed - This error is generally related to the security protocol type. One customer resolved their issue by force TLS 1.2 and compiling their app with the latest version of .NET.
• Auth Failed because remote party has closed the transport stream - You may get this error when trying to call an external API. This error is related to the Security Protocol Type, it is most likely caused by your application's default security protocol type being set too low, A lot of external APIs now expect requests using TLS 1.2 or above.

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.