Adding validate-client-certificate policy makes the request connection failed

Question

Adding validate-client-certificate policy makes the request connection failed

Jia Xie 0 Microsoft Employee

Adding validate-client-certificate policy makes the request failed with: An error occurred while sending the request when I use HttpClient making the request.

Policy:

        <validate-client-certificate validate-not-before="true" validate-not-after="true" ignore-error="false" validate-revocation="false">
            <identities>
                <identity subject="CN=xxx" issuer-subject="CN=xxxx" />
            </identities>
        </validate-client-certificate>

I tested the same request with Bruno and Bruno failed with:

Socket error: read ECONNRESET

there was an error executing the request!

{"errno":-4077,"code":"ECONNRESET","syscall":"read"}

Pashikanti Kumar 1,725 Reputation points Microsoft External Staff Moderator

2025-11-26T20:07:52.55+00:00
Hi Jia Xie

Thanks for reaching out on Microsoft Q&A.

The "validate-client-certificate" policy in API Management can cause connection failures such as "An error occurred while sending the request" with HttpClient because the client certificate validation may fail or cause the connection to be forcibly closed (ECONNRESET). This often happens if the client does not properly send a valid certificate or the full certificate chain required by the policy.

Ensure the HttpClient is configured to send the client certificate properly. This includes loading the client certificate into HttpClientHandler.ClientCertificates and setting ClientCertificateOptions to Manual.

The server may require the entire certificate chain. Double-check if intermediate and root CA certificates need to be included on the client side or properly trusted on the server.

The policy attributes "validate-not-before" and "validate-not-after" enforce validity period checks on the certificate, which could cause failures if the certificate is expired or not yet valid.

If "validate-revocation" is false but other checks fail (like issuer or subject mismatch), connection will be closed.

The ECONNRESET error indicates the remote server closed the connection abruptly, often because the client certificate validation did not pass on the server side.

Testing with tools like Postman that support client certificates can help isolate whether the problem is with client certificate sending or the policy validation itself.
Jia Xie 0 Reputation points Microsoft Employee

2025-11-26T21:35:23.31+00:00

Hi,

I am confident that HttpClient is set up to send the client certificate correctly. I have added the certificate to HttpClientHandler.ClientCertificates and configured ClientCertificateOptions to Manual, but the issue remains.

The certificate is valid and will expire 3 months later.

As mentioned earlier, I used Bruno with the certificate set up to send the request, but it still failed and showed the error message:

Socket error: read ECONNRESET

there was an error executing the request!

{"errno":-4077,"code":"ECONNRESET","syscall":"read"}

{"errno":-4077,"code":"ECONNRESET","syscall":"read"}
Pashikanti Kumar 1,725 Reputation points Microsoft External Staff Moderator

2025-11-26T23:02:14+00:00
Hi Jia Xie

The ECONNRESET error you and Bruno are encountering when calling the Azure API Management (APIM) endpoint with client certificate validation enabled indicates the connection is forcibly closed by the server. Despite correctly configuring HttpClient to send the certificate and the certificate being valid, this is often caused by APIM rejecting the certificate during the mTLS handshake or policy evaluation.

The validate-client-certificate policy in APIM requires that the client certificate identity (subject and issuer) matches exactly what is configured in the policy. Any mismatch causes APIM to reset the connection. Double-check the identities element subject and issuer in the policy match the certificate exactly

APIM validates the entire certificate chain. If intermediate CA certificates are missing or the root CA is not uploaded to APIM’s certificate store, validation fails, sometimes causing connection reset. Make sure the full chain leading to a trusted root CA is uploaded and configured in APIM.

Revocation checking disables some scenarios with self-signed or internal CA certs. Since you have validate-revocation="false", this is good, but ensure chain validation is consistent with your certs/APIM setup

The client certificate or its chain is not properly uploaded/trusted in APIM.

The policy’s identity criteria do not match the presented certificate exactly.

TLS termination at intermediate proxies prevents client cert forwarding to APIM.
Pravallika KV 2,690 Reputation points Microsoft External Staff Moderator

2025-11-27T02:31:25.29+00:00

Hi @Jia Xie , following up to see if you got a chance to check the above response and if it was helpful. If you have any further queries, please do let us know.

Your answer

Pashikanti Kumar 1,725 Reputation points Microsoft External Staff Moderator

2025-11-26T20:07:52.55+00:00

Hi Jia Xie

Thanks for reaching out on Microsoft Q&A.

The "validate-client-certificate" policy in API Management can cause connection failures such as "An error occurred while sending the request" with HttpClient because the client certificate validation may fail or cause the connection to be forcibly closed (ECONNRESET). This often happens if the client does not properly send a valid certificate or the full certificate chain required by the policy.

Ensure the HttpClient is configured to send the client certificate properly. This includes loading the client certificate into HttpClientHandler.ClientCertificates and setting ClientCertificateOptions to Manual.

The server may require the entire certificate chain. Double-check if intermediate and root CA certificates need to be included on the client side or properly trusted on the server.

The policy attributes "validate-not-before" and "validate-not-after" enforce validity period checks on the certificate, which could cause failures if the certificate is expired or not yet valid.

If "validate-revocation" is false but other checks fail (like issuer or subject mismatch), connection will be closed.

The ECONNRESET error indicates the remote server closed the connection abruptly, often because the client certificate validation did not pass on the server side.

Testing with tools like Postman that support client certificates can help isolate whether the problem is with client certificate sending or the policy validation itself.
Jia Xie 0 Reputation points Microsoft Employee

2025-11-26T21:35:23.31+00:00

Hi,

I am confident that HttpClient is set up to send the client certificate correctly. I have added the certificate to HttpClientHandler.ClientCertificates and configured ClientCertificateOptions to Manual, but the issue remains.

The certificate is valid and will expire 3 months later.

As mentioned earlier, I used Bruno with the certificate set up to send the request, but it still failed and showed the error message:

Socket error: read ECONNRESET

there was an error executing the request!

{"errno":-4077,"code":"ECONNRESET","syscall":"read"}

{"errno":-4077,"code":"ECONNRESET","syscall":"read"}
Pashikanti Kumar 1,725 Reputation points Microsoft External Staff Moderator

2025-11-26T23:02:14+00:00

Hi Jia Xie

The ECONNRESET error you and Bruno are encountering when calling the Azure API Management (APIM) endpoint with client certificate validation enabled indicates the connection is forcibly closed by the server. Despite correctly configuring HttpClient to send the certificate and the certificate being valid, this is often caused by APIM rejecting the certificate during the mTLS handshake or policy evaluation.

The validate-client-certificate policy in APIM requires that the client certificate identity (subject and issuer) matches exactly what is configured in the policy. Any mismatch causes APIM to reset the connection. Double-check the identities element subject and issuer in the policy match the certificate exactly

APIM validates the entire certificate chain. If intermediate CA certificates are missing or the root CA is not uploaded to APIM’s certificate store, validation fails, sometimes causing connection reset. Make sure the full chain leading to a trusted root CA is uploaded and configured in APIM.

Revocation checking disables some scenarios with self-signed or internal CA certs. Since you have validate-revocation="false", this is good, but ensure chain validation is consistent with your certs/APIM setup

The client certificate or its chain is not properly uploaded/trusted in APIM.

The policy’s identity criteria do not match the presented certificate exactly.

TLS termination at intermediate proxies prevents client cert forwarding to APIM.
Pravallika KV 2,690 Reputation points Microsoft External Staff Moderator

2025-11-27T02:31:25.29+00:00

Hi @Jia Xie , following up to see if you got a chance to check the above response and if it was helpful. If you have any further queries, please do let us know.

Share via

Adding validate-client-certificate policy makes the request connection failed

Your answer