Xamarin Android SSL Error connecting to SignalR

Question

Hi I am all of a sudden getting an SSL error when connecting to SignalR from my Xamarin Android app. it is only on Android, not on iPhone.

I am running dot net core WebApi and can connect to that from the Android app (https://) , but SignalR is throwing an error when running the StartAsync() method on the hub connection

Any ideas how to resolve or how to investigate this further please?

Message "The SSL connection could not be established, see inner exception."

InnerException {System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---> Mono.Btls.MonoBtlsException: Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED at /Users/builder/jenkins/workspace/archive-mono/…}

StackTrace " at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore (System.IO.Stream stream, System.Net.Security.SslClientAuthenticationOptions sslOptions, System.Threading.CancellationToken cancellationToken) [0x000f6] in /Users/builder/jenkins/workspace/arch…"

Answer 1

android is complaining that the SSL certificate is not trusted. that is its not signed by trusted source. if this is a self signed certificate, you must install it on the phone. google for instructions for your version of Android.

if you paid for the cert, the seller is not trusted.

Answer 2

Probably releated to DST Root CA X3 expiration of LetsEncrypt certificates Sept 20, 2021

https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

the following issue has been posted on xamarin-android on github.

https://github.com/xamarin/xamarin-android/issues/6351

We have no solution yet, The suggested workaround of renewing LetsEncrypt Acme did not work for us

Answer 3

I've posted the workaround at https://github.com/xamarin/xamarin-android/issues/6351#issuecomment-931987612

Answer 4

I posted my workaround for kubernetes with Cert-Manager environment: https://github.com/xamarin/xamarin-android/issues/6351#issuecomment-936909856
Basically I added the preferredChain: "ISRG Root X1" line to the ClusterIssuer yaml recipe.