Cosmos EF Core component ignore emulator certificate

[christiannagel]

When using AddAzureCosmosDB the emulator certificate can be ignored as implemented with #1668

I try to use the EF Core version AddCosmosDbContext. With this it looks like this option to ignore the emulator certificate is not available.

[davidfowl]

cc @JamesNK

[JamesNK]

That setting is removed in #2008

Although I'm not sure if AddCosmosDbContext builds the right connection string to ignore the cert.

[christiannagel]

@JamesNK it looks like it doesn't use the right connection string - I'm getting errors.

[JamesNK]

That change is for preview 4. It isn't publicly released.

Are you using preview 3 or a nightly build?

[christiannagel]

Preview 3 - to allow easier checks for my technical reviewers

And this is an exception I see with the emulator:

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
       ---> System.IO.IOException: Received an unexpected EOF or 0 bytes from the transport stream.
         at System.Net.Security.SslStream.ReceiveHandshakeFrameAsync[TIOAdapter](CancellationToken cancellationToken)
         at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
         at System.Net.Security.SslStream.ProcessAuthenticationWithTelemetryAsync(Boolean isAsync, CancellationToken cancellationToken)
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         --- End of inner exception stack trace ---

[JamesLMiller]

@christiannagel I am getting the same. The only workaround I have found is when setting up my DB context is to do as the documentation says as so:

protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
{
    optionsBuilder.UseCosmos("AccountEndpoint = https://localhost:8081/;AccountKey=C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==", "cosmos",
        x => {
            x.HttpClientFactory(() => new HttpClient(new HttpClientHandler()
            {
                ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
            }));
            x.ConnectionMode(Microsoft.Azure.Cosmos.ConnectionMode.Gateway);
        });
}

Doing the above still gives me SSL errors, so in my Web project for my Aspire app I have had to:

ServicePointManager.ServerCertificateValidationCallback += (sender, certificate, chain, sslPolicyErrors) => true;

Obviously this is not ideal, but for testing it does allow me to at least make a connection to the Cosmos Emulator.

[christiannagel]

@JamesNK I missed updating one of the packages with this project. The IgnoreEmulatorCertificate option indeed is available with preview 3. However, it still throws with the same error.

@JamesLMiller - thanks for the workaround.

I'm not changing the DbContext as I'm usingt a NuGet package that's also used with Cosmos running in Azure: https://www.nuget.org/packages/CNinnovation.Codebreaker.Cosmos/, but managed to use your workaround with the DI container configuration ignoring the Cosmos component in the debug case:

#if DEBUG
            builder.Services.AddDbContext<IGamesRepository, GamesCosmosContext>(options =>
            {
                options.UseCosmos("AccountEndpoint = https://localhost:8081/;AccountKey=C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==", "codebreaker",
                 cosmosOptions => {
                    cosmosOptions.HttpClientFactory(() => new HttpClient(new HttpClientHandler()
                    {
                        ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
                    }));
                    cosmosOptions.ConnectionMode(ConnectionMode.Gateway);
                });
            });
#else
            builder.AddCosmosDbContext<GamesCosmosContext>("codebreaker", "codebreaker",
                configureDbContextOptions: static options =>
                {
                    options.UseQueryTrackingBehavior(QueryTrackingBehavior.NoTracking);
                });

            builder.Services.AddScoped<IGamesRepository, DataContextProxy<GamesCosmosContext>>();
#endif

Looking forward to updating this with preview 4.

[allantargino]

I was using preview 3 and I had the same issue - but I tested the latest code from main using the playground and I didn't have any problems.

Also, seems the package used by preview 3 have the issue Azure/azure-cosmos-dotnet-v3#4315. Now their latest non-preview release (which contains the fix) is the same one already being used by Aspire.

Just posting it here for correlation, since the issue experimented by you @christiannagel may be related to that, although already fixed by Aspire.

[eerhardt]

I'm going to close this as fixed with preview4. If the problem still exists in the preview4 builds, please re-open.

[JamesLMiller]

@JamesNK I missed updating one of the packages with this project. The IgnoreEmulatorCertificate option indeed is available with preview 3. However, it still throws with the same error.

@JamesLMiller - thanks for the workaround.

I'm not changing the DbContext as I'm usingt a NuGet package that's also used with Cosmos running in Azure: https://www.nuget.org/packages/CNinnovation.Codebreaker.Cosmos/, but managed to use your workaround with the DI container configuration ignoring the Cosmos component in the debug case:

#if DEBUG
            builder.Services.AddDbContext<IGamesRepository, GamesCosmosContext>(options =>
            {
                options.UseCosmos("AccountEndpoint = https://localhost:8081/;AccountKey=C2y6yDjf5/R+ob0N8A7Cgv30VRDJIWEHLM+4QDU5DE2nQ9nDuVTqobD4b8mGGyPMbIZnqyMsEcaGQy67XIw/Jw==", "codebreaker",
                 cosmosOptions => {
                    cosmosOptions.HttpClientFactory(() => new HttpClient(new HttpClientHandler()
                    {
                        ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
                    }));
                    cosmosOptions.ConnectionMode(ConnectionMode.Gateway);
                });
            });
#else
            builder.AddCosmosDbContext<GamesCosmosContext>("codebreaker", "codebreaker",
                configureDbContextOptions: static options =>
                {
                    options.UseQueryTrackingBehavior(QueryTrackingBehavior.NoTracking);
                });

            builder.Services.AddScoped<IGamesRepository, DataContextProxy<GamesCosmosContext>>();
#endif

Looking forward to updating this with preview 4.

One thing that I noted in some of my testing for my app, is that if I give the emulator time to fully start up (sometimes almost a whole minute) I will not get the SSL errors when connecting. If I don't give it time to connect, and try to use the my database context to call "EnsureCreated" I will still get the SSL issues.

[davidfowl]

I see similar problems with the cosmos emulator