3

I am trying to connect to a website via a proxy. This is happening in an AWS Lambda with .NET Core SDK using an http client. The call looks pretty much like this:

handler = new HttpClientHandler()
{
 CookieContainer = cookieContainer,
     Proxy = new WebProxy(
                new Uri(Environment.GetEnvironmentVariable("proxyURL"))),
     ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator,
     SslProtocols = SslProtocols.Tls12,
     ClientCertificateOptions = ClientCertificateOption.Manual
};

using(var client = new HttpClient(handler))
{
     var content = await client.GetAsync("https://my-website.com/");
}

I am not able to make the call to "https://my-website.com/". The call times out without an error message.

However I was able to access the website using Golang and resty in an AWS Lambda, skipping the TLS Check:

client := resty.New()
resp, err := client.
    SetProxy(os.Getenv("proxyURL")).
    SetRetryCount(3).SetTimeout(3*time.Second).SetTLSClientConfig(&tls.Config{InsecureSkipVerify: true}).
    R().Get("https://my-website.com/")

My question is: how can I achieve the behaviour from my Golang Code in my .NET Core Code?

ingoaf
  • 51
  • 1
  • 8
  • 2
    `DangerousAcceptAnyServerCertificateValidator` already achieves the aim of ignoring certificate validation problems, so: I don't think that is the problem – Marc Gravell Dec 17 '21 at 11:16
  • It will work for you. Check it out: https://stackoverflow.com/a/55496011/10396609 – ban Dec 17 '21 at 22:25

1 Answers1

2

TL; DR: The problem lied not within certificate validation, but in a security group rule.

  1. As Marc Gravell kindly pointed out, the DangerousAcceptAnyServerCertificateValidator already achieves the aim of ignoring certificate validation problems.
  2. After deploying the same code in an EC2 instance in the same VPC and subnet I noticed, that the .NET Core code was making one more HTTP call than the Go code (Although I still do not understand why). The IP adress was not within the allowed IP range of outgoing traffic, thus blocking the request and causing a timeout of the HttpClient.
ingoaf
  • 51
  • 1
  • 8