Azure Web App- Could not establish trust relationship for the SSL/TLS secure channel

Question

I have Web Job and Web API running on same Web App in Azure. Web Job access Web API over Https. But it throws below error while trying to access Web API:

An error occurred while sending the request. The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

Answer 1

Add the following to your code, this sets your runtime to accept the SSL/TLS connection.

System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;

Answer 2

I had this same problem. It happened because I created a custom domain without SSL binding. When you create a custom binding in an Azure web app, Azure defaults to HTTPS. If you do not add an SSL binding, on the Custom domains page for your Azure App Services app be sure you have unselected the HTTPS Only button.

Answer 3

Adding following code to webjob on startup solved the issue.

ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true;

Answer 4

I want to add some light on this SSL handshake and communication over HTTPS. If you're facing this issue "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel" it means one of the below condition not met:

1. Certificate signatures are valid
2. Certificate chain ends at a trusted root
3. Chain has valid basic constraints
4. Successful revocation check / not revoked. CRL endpoint is accessible. or due to below constraint:
5. Chain has name constraint policies.
6. Chain has certificate policies
7. Chain has extended key usages
8. Chain has SubjectKeyIdentifier / AuthorityKeyIdentifier match

If you're using Azure web app with domain {webappname}.azurewebsites.net and using internal private certificate then there is no workaround of this issue other than below three options as this is unsupported scenario: I) App service environment I))need to bypass the SSL validation III) Use well known Certificate Authority certificate to make it work.

Why unsupported scenario: you cannot install new certificate authority on web app level because you're using shareable resources and not dedicated. Even if you install the certificate to azure using app configuration "WEBSITES_LOAD_CERTIFICATES" it don't allows to install the certificate inside certificate store.

You can learn the failure through network trace and it should failed at "Authentication and Pre-master secret" stage which is after server hello.

I hope this information helps.