.NET 7, Linux, SSL connection is being reused between independent HttpClients?

[alexandrehtrb]

Description

Hello,

The website to which I want to connect requires a client certificate and I am using two different HttpClients, one with and other without the cert. The one with it is supposed to connect and the other should not.

• HttpClient 1 no cert, when request, should receive 400 Bad Request
• HttpClient 2 has cert, when request, should receive 200 OK

The scenario above works correctly under .NET 6, but on .NET 7, the outcome is different:

• If HttpClient 1 calls first, it receives 400 Bad Request. When HttpClient 2 calls subsequently, it also receives 400 Bad Request, even having a client certificate.
• If HttpClient 2 calls first, it receives 200 OK. When HttpClient 1 calls subsequently, it also receives 200 OK, even not having a client certificate.

This problem happens only on Linux; on Windows, the behavior is correct, the same as in .NET 6. I did not test on MacOSX.
The website that I use to test client certificates is https://badssl.com/ (it has certificates for testing).
Code for how the HttpClients are being built: link

Reproduction Steps

Video below

Comportamento.HttpClient.ClientCertificate.Dotnet7.webm

Expected behavior

HttpClients with different HttpMessageHandlers should work independently, I believe

Actual behavior

.

Regression?

This problem does not happen in .NET 6

Known Workarounds

No response

Configuration

dotnet --info

.NET SDK:
 Version: 7.0.101
 Commit: bb24aafa11

Ambiente de runtime:
 OS Name: arch
 OS Version: 
 OS Platform: Linux
 RID: arch-x64
 Base Path: /home/alexandre/.dotnet/sdk/7.0.101/

Host:
 Version: 7.0.1
 Architecture: x64
 Commit: 97203d38ba

.NET SDKs installed:
 6.0.403 [/home/alexandre/.dotnet/sdk]
 7.0.101 [/home/alexandre/.dotnet/sdk]

.NET runtimes installed:
 Microsoft.AspNetCore.App 6.0.11 [/home/alexandre/.dotnet/shared/Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 7.0.1 [/home/alexandre/.dotnet/shared/Microsoft.AspNetCore.App]
 Microsoft.NETCore.App 6.0.11 [/home/alexandre/.dotnet/shared/Microsoft.NETCore.App]
 Microsoft.NETCore.App 7.0.1 [/home/alexandre/.dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
 None

Environment variables:
 DOTNET_ROOT [/home/alexandre/.dotnet/]

global.json file:
 Not found

Other information

No response

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Hello,

The website to which I want to connect requires a client certificate and I am using two different HttpClients, one with and other without the cert. The one with it is supposed to connect and the other should not.

• HttpClient 1 no cert, when request, should receive 400 Bad Request
• HttpClient 2 has cert, when request, should receive 200 OK

The scenario above works correctly under .NET 6, but on .NET 7, the outcome is different:

• If HttpClient 1 calls first, it receives 400 Bad Request. When HttpClient 2 calls subsequently, it also receives 400 Bad Request, even having a client certificate.
• If HttpClient 2 calls first, it receives 200 OK. When HttpClient 1 calls subsequently, it also receives 200 OK, even not having a client certificate.

This problem happens only on Linux; on Windows, the behavior is correct, the same as in .NET 6. I did not test on MacOSX.
The website that I use to test client certificates is https://badssl.com/ (it has certificates for testing).
Code for how the HttpClients are being built: link

Reproduction Steps

Video below

Comportamento.HttpClient.ClientCertificate.Dotnet7.webm

Expected behavior

HttpClients with different HttpMessageHandlers should work independently, I believe

Actual behavior

.

Regression?

This problem does not happen in .NET 6

Known Workarounds

No response

Configuration

dotnet --info

.NET SDK:
 Version: 7.0.101
 Commit: bb24aafa11

Ambiente de runtime:
 OS Name: arch
 OS Version: 
 OS Platform: Linux
 RID: arch-x64
 Base Path: /home/alexandre/.dotnet/sdk/7.0.101/

Host:
 Version: 7.0.1
 Architecture: x64
 Commit: 97203d38ba

.NET SDKs installed:
 6.0.403 [/home/alexandre/.dotnet/sdk]
 7.0.101 [/home/alexandre/.dotnet/sdk]

.NET runtimes installed:
 Microsoft.AspNetCore.App 6.0.11 [/home/alexandre/.dotnet/shared/Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 7.0.1 [/home/alexandre/.dotnet/shared/Microsoft.AspNetCore.App]
 Microsoft.NETCore.App 6.0.11 [/home/alexandre/.dotnet/shared/Microsoft.NETCore.App]
 Microsoft.NETCore.App 7.0.1 [/home/alexandre/.dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
 None

Environment variables:
 DOTNET_ROOT [/home/alexandre/.dotnet/]

global.json file:
 Not found

Other information

No response

Author:	alexandrehtrb
Assignees:	-
Labels:	area-System.Net.Http
Milestone:	-

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Hello,

The website to which I want to connect requires a client certificate and I am using two different HttpClients, one with and other without the cert. The one with it is supposed to connect and the other should not.

• HttpClient 1 no cert, when request, should receive 400 Bad Request
• HttpClient 2 has cert, when request, should receive 200 OK

The scenario above works correctly under .NET 6, but on .NET 7, the outcome is different:

• If HttpClient 1 calls first, it receives 400 Bad Request. When HttpClient 2 calls subsequently, it also receives 400 Bad Request, even having a client certificate.
• If HttpClient 2 calls first, it receives 200 OK. When HttpClient 1 calls subsequently, it also receives 200 OK, even not having a client certificate.

This problem happens only on Linux; on Windows, the behavior is correct, the same as in .NET 6. I did not test on MacOSX.
The website that I use to test client certificates is https://badssl.com/ (it has certificates for testing).
Code for how the HttpClients are being built: link

Reproduction Steps

Video below

Comportamento.HttpClient.ClientCertificate.Dotnet7.webm

Expected behavior

HttpClients with different HttpMessageHandlers should work independently, I believe

Actual behavior

.

Regression?

This problem does not happen in .NET 6

Known Workarounds

No response

Configuration

dotnet --info

.NET SDK:
 Version: 7.0.101
 Commit: bb24aafa11

Ambiente de runtime:
 OS Name: arch
 OS Version: 
 OS Platform: Linux
 RID: arch-x64
 Base Path: /home/alexandre/.dotnet/sdk/7.0.101/

Host:
 Version: 7.0.1
 Architecture: x64
 Commit: 97203d38ba

.NET SDKs installed:
 6.0.403 [/home/alexandre/.dotnet/sdk]
 7.0.101 [/home/alexandre/.dotnet/sdk]

.NET runtimes installed:
 Microsoft.AspNetCore.App 6.0.11 [/home/alexandre/.dotnet/shared/Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 7.0.1 [/home/alexandre/.dotnet/shared/Microsoft.AspNetCore.App]
 Microsoft.NETCore.App 6.0.11 [/home/alexandre/.dotnet/shared/Microsoft.NETCore.App]
 Microsoft.NETCore.App 7.0.1 [/home/alexandre/.dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
 None

Environment variables:
 DOTNET_ROOT [/home/alexandre/.dotnet/]

global.json file:
 Not found

Other information

No response

Author:	alexandrehtrb
Assignees:	-
Labels:	area-System.Net.Security, untriaged
Milestone:	-

[wfurt]

This is likely caused by #64369. The TLS resume is independent of any HTTP so the it does not matter if one or more HttpClients are used. What matters is how the client certificate is set and what host you are connecting to. If the target and provided certificate is the same, we will try TLS resume without full handshake. This should be same on Windows where the TLS cache is global per whole system.
I tried to look at come of code you linked but it is not quite clear what is going on (besides setting collection on HttpClientHandler). Could you create simple unable repro?

Lastly, you can set DOTNET_SYSTEM_NET_SECURITY_DISABLETLSRESUME=1 or System.Net.Security.DisableTlsResume via AppContext to get old behavior.

This issue has been marked needs-author-action and may be missing some important information.

[alexandrehtrb]

@wfurt , I made a console app to reproduce this:
https://github.com/alexandrehtrb/ExampleHttpClientCertificate

[wfurt]

Thanks @alexandrehtrb. I understand what is happening and it is not intentional.