Excited to finally try out Aspire but SSL error running starter project

[sgentry]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I created a new app, using the Aspire Starter App template, and it immediately throws SSL connection error. I'm on Windows 11 running Docker Desktop v4.38.0. Not sure where to go from here and curious why Kubernetes Container is in the error message? My searching hasn't turned up anything obvious to me and I'm not sure what it's trying to authenticate to.

I tried running dotnet dev-certs https --clean and dotnet dev-certs https --trust

Expected Behavior

I expect project to run without errors and to be able to access the Aspire dashboard.

Steps To Reproduce

Scaffold new project and attempt to run it.

Exceptions (if any)

info: Aspire.Hosting.DistributedApplication[0]
      Aspire version: 9.0.0+01ed51919f8df692ececce51048a140615dc759d
info: Aspire.Hosting.DistributedApplication[0]
      Distributed application starting.
info: Aspire.Hosting.DistributedApplication[0]
      Application host directory is: C:\Temp\AspireApp1\AspireApp1.AppHost
crit: Aspire.Hosting.Dcp.ApplicationExecutor[0]
      Watch task over Kubernetes Executable resources terminated unexpectedly.
      System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
       ---> System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback.
         at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
         at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         --- End of inner exception stack trace ---
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.InjectNewHttp2ConnectionAsync(QueueItem queueItem)
         at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
         at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
         at k8s.Kubernetes.SendRequestRaw(String requestContent, HttpRequestMessage httpRequest, CancellationToken cancellationToken)
         at k8s.AbstractKubernetes.ICustomObjectsOperations_ListClusterCustomObjectWithHttpMessagesAsync[T](String group, String version, String plural, Nullable`1 allowWatchBookmarks, String continueParameter, String fieldSelector, String labelSelector, Nullable`1 limit, String resourceVersion, String resourceVersionMatch, Nullable`1 timeoutSeconds, Nullable`1 watch, Nullable`1 pretty, IReadOnlyDictionary`2 customHeaders, CancellationToken cancellationToken)
         at k8s.AbstractKubernetes.k8s.ICustomObjectsOperations.ListClusterCustomObjectWithHttpMessagesAsync(String group, String version, String plural, Nullable`1 allowWatchBookmarks, String continueParameter, String fieldSelector, String labelSelector, Nullable`1 limit, String resourceVersion, String resourceVersionMatch, Nullable`1 timeoutSeconds, Nullable`1 watch, Nullable`1 pretty, IReadOnlyDictionary`2 customHeaders, CancellationToken cancellationToken)
         at k8s.WatcherExt.<>c__DisplayClass1_0`2.<<MakeStreamReaderCreator>b__0>d.MoveNext()
      --- End of stack trace from previous location ---
         at k8s.Watcher`1.<>c.<CreateWatchEventEnumerator>b__21_1[TR](Task`1 t)
         at System.Threading.Tasks.ContinuationResultTaskFromResultTask`2.InnerInvoke()
         at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
      --- End of stack trace from previous location ---
         at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)
         at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Task& currentTaskSlot, Thread threadPoolThread)
      --- End of stack trace from previous location ---
         at k8s.Watcher`1.CreateWatchEventEnumerator(Func`1 streamReaderCreator, Action`1 onError, CancellationToken cancellationToken)+MoveNext()
         at k8s.Watcher`1.CreateWatchEventEnumerator(Func`1 streamReaderCreator, Action`1 onError, CancellationToken cancellationToken)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult()
         at Aspire.Hosting.Dcp.KubernetesService.WatchAsync[T](String namespaceParameter, CancellationToken cancellationToken)+MoveNext() in /_/src/Aspire.Hosting/Dcp/KubernetesService.cs:line 260
         at Aspire.Hosting.Dcp.KubernetesService.WatchAsync[T](String namespaceParameter, CancellationToken cancellationToken)+MoveNext() in /_/src/Aspire.Hosting/Dcp/KubernetesService.cs:line 260
         at Aspire.Hosting.Dcp.KubernetesService.WatchAsync[T](String namespaceParameter, CancellationToken cancellationToken)+System.Threading.Tasks.Sources.IValueTaskSource<System.Boolean>.GetResult()
         at Aspire.Hosting.Dcp.ApplicationExecutor.<>c__DisplayClass40_1`1.<<WatchResourceChanges>b__10>d.MoveNext() in /_/src/Aspire.Hosting/Dcp/ApplicationExecutor.cs:line 355
      --- End of stack trace from previous location ---
         at Aspire.Hosting.Dcp.ApplicationExecutor.<>c__DisplayClass40_1`1.<<WatchResourceChanges>b__10>d.MoveNext() in /_/src/Aspire.Hosting/Dcp/ApplicationExecutor.cs:line 355
      --- End of stack trace from previous location ---
         at Polly.ResiliencePipeline.<>c.<<ExecuteAsync>b__3_0>d.MoveNext()
      --- End of stack trace from previous location ---
         at Polly.Outcome`1.GetResultOrRethrow()
         at Polly.ResiliencePipeline.ExecuteAsync(Func`2 callback, CancellationToken cancellationToken)
         at Aspire.Hosting.Dcp.ApplicationExecutor.<>c__DisplayClass40_0.<<WatchResourceChanges>g__WatchKubernetesResourceAsync|3>d`1.MoveNext() in /_/src/Aspire.Hosting/Dcp/ApplicationExecutor.cs:line 353

.NET Version info

.NET SDK:
Version: 9.0.102
Commit: cb83cd4923
Workload version: 9.0.100-manifests.4a54b1a6
MSBuild version: 17.12.18+ed8c6aec5

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22631
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\9.0.102\

.NET workloads installed:
[maui-windows]
Installation Source: VS 17.12.35707.178
Manifest Version: 9.0.14/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.sdk.maui\9.0.14\WorkloadManifest.json
Install Type: Msi

[maccatalyst]
Installation Source: VS 17.12.35707.178
Manifest Version: 18.1.9163/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.sdk.maccatalyst\18.1.9163\WorkloadManifest.json
Install Type: Msi

[ios]
Installation Source: VS 17.12.35707.178
Manifest Version: 18.1.9163/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.sdk.ios\18.1.9163\WorkloadManifest.json
Install Type: Msi

[android]
Installation Source: VS 17.12.35707.178
Manifest Version: 35.0.7/9.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\9.0.100\microsoft.net.sdk.android\35.0.7\WorkloadManifest.json
Install Type: Msi

[aspire]
Installation Source: VS 17.12.35707.178
Manifest Version: 8.2.2/8.0.100
Manifest Path: C:\Program Files\dotnet\sdk-manifests\8.0.100\microsoft.net.sdk.aspire\8.2.2\WorkloadManifest.json
Install Type: Msi

Configured to use loose manifests when installing new manifests.

Host:
Version: 9.0.1
Architecture: x64
Commit: c8acea2262

.NET SDKs installed:
8.0.405 [C:\Program Files\dotnet\sdk]
9.0.102 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.1 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.1 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 7.0.20 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 8.0.12 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 9.0.1 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
x86 [C:\Program Files (x86)\dotnet]
registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
Not set

global.json file:
Not found

Anything else?

Using latest verfsion of Visual Studio to run project.

[davidfowl]

Is this a work machine with corporate policy blocking self signed certs?

@karolz-ms does this sound familiar?

[sgentry]

This is on a work machine. I don't believe self-signed certs are blocked but I'm digging around to see how I can verify. If there's a specific policy I should check, let me know. Thanks!

[sgentry]

I don't think it's a corporate policy. I can run my API's, with https, locally using the dev-certs and that works fine. Is there any other information I can provide that might help identify issue?

[davidfowl]

HTTPS APIs are different from the self signed cert we generate for client to server auth.

[sgentry]

Can I override self-signed and specify my own certs? I get the same exception even if I switch to http transport following these instructions: https://learn.microsoft.com/en-us/dotnet/aspire/troubleshooting/allow-unsecure-transport?tabs=windows

[danegsta]

@sgentry do you have any kind of proxy running for localhost traffic? We've seen certificate issues in the past for users who have local traffic being proxied (in some cases via an accidental proxy config and in others all IPv6 traffic was being proxied, but IPv4 worked as expected).

The orchestrator layer doesn't currently support self-signed certificates, but that's something we could consider in the future if there's enough interest.

[sgentry]

No, I don't have any local proxy setup that I'm aware of. Up until the middle of last year we did have to use our corporate proxy, which caused various issues. As far as I can tell, I've cleared out all previous configuration I had set for corp proxy. I'll keep poking around and see if I can get another developer to test it out on their machine.

In regards to providing my own cert, I was thinking about generating new certs from a trusted Vault CA we use in our development environment.

[sgentry]

I engaged with two other developers on my team. Works as expected for developer on a Mac but same error for the other dev running on Windows. I'll continue to troubleshoot from my end...

[JFelton]

I've run into this with our company proxy server during evaluation to promote for use by our development staff.

I'm able to get aspire to start correctly when removing the Windows Environment Variables for both HTTP_PROXY & HTTPS_PROXY. The NO_PROXY does not have to be removed. Of course closing and reopening visual studio.

I'm looking for a way to promote the use of .Net Aspire within our company, yet need an acceptable answer for this proxy interference.

[danegsta]

@JFelton the general recommendation for scenarios like this would be to exclude local machine traffic from proxies. Unless your proxy is running on the individual developer machines (which generally defeats the purpose of a shared corporate proxy), it’s not going to be able to resolve localhost traffic back to your machine. Adding localhost/127.0.0.1 to the NO_PROXY environment variable got Aspire is more of a workaround for an improperly configured proxy routing setup that isn’t already excluding localhost traffic.

[sgentry]

In my case I no longer use the corporate proxy and have removed the HTTP_PROXY env variables.

I was troubleshooting this with our desktop support today and there are not any policies enabled that would interfere with certs that they're aware of. Is there something specific we should look at?

I can see that kubeconfig is created under Users\AppData\Local\Temp\Aspire.... Is the certificate-authority-data generated every time you run the app? Is this the CA that needs to be trusted on my machine?

If you have any ideas on how I could troubleshoot this, it would be much appreciated.

[danegsta]

@sgentry there shouldn't be any need to explicitly trust the CA certificate as the C# KubernetesClient library automatically validates against the CA cert in the kubeconfig. The two primary scenarios that could cause that check in the KubernetesClient library to fail would be a mismatch between the NotBefore/NotAfter settings for the certificate and the current system clock or a mismatch between the subject name of the certificate and the address it was actually requested for (the certificate has its subject name set to the loopback address that the orchestration layer is running on).