dotnet SSL error

[shawndengucf]

Hi thank you for posting this great repo. I'm trying to run the provided sample/dotnet notebooks locally but I bumped into SSL error. I tried to find out solutions to handle "dotnet SSL error" but no luck so far. Could someone please help? Thanks in advance.

Below is the error message:
System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: RevocationStatusUnknown at System.Net.Security.SslStream.SendAuthResetSignal(ProtocolToken message, ExceptionDispatchInfo exception) at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions) at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken) at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) --- End of inner exception stack trace --- at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(QueueItem queueItem) at System.Threading.Tasks.TaskCompletionSourceWithCancellation1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.HttpConnectionWaiter1.WaitForConnectionAsync(Boolean async, CancellationToken requestCancellationToken) at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken) at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken) at Microsoft.SemanticKernel.AI.OpenAI.Clients.AzureOpenAIClientAbstract.CacheDeploymentsAsync() at Microsoft.SemanticKernel.AI.OpenAI.Clients.AzureOpenAIClientAbstract.GetDeploymentNameAsync(String modelId) at Microsoft.SemanticKernel.AI.OpenAI.Services.AzureTextEmbeddings.GenerateEmbeddingsAsync(IList1 data)
at Microsoft.SemanticKernel.AI.Embeddings.EmbeddingGeneratorExtensions.GenerateEmbeddingAsync[TValue,TEmbedding](IEmbeddingGenerator2 generator, TValue value) at Microsoft.SemanticKernel.Memory.SemanticTextMemory.SaveInformationAsync(String collection, String text, String id, String description, CancellationToken cancel) at Submission#6.<<Initialize>>d__0.MoveNext() --- End of stack trace from previous location --- at Microsoft.CodeAnalysis.Scripting.ScriptExecutionState.RunSubmissionsAsync[TResult](ImmutableArray1 precedingExecutors, Func2 currentExecutor, StrongBox1 exceptionHolderOpt, Func2 catchExceptionOpt, CancellationToken cancellationToken) at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(QueueItem queueItem) at System.Threading.Tasks.TaskCompletionSourceWithCancellation1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.HttpConnectionWaiter1.WaitForConnectionAsync(Boolean async, CancellationToken requestCancellationToken) at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken) at System.Net.Http.DiagnosticsHandler.SendAsyncCore(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken) at Microsoft.SemanticKernel.AI.OpenAI.Clients.AzureOpenAIClientAbstract.CacheDeploymentsAsync() at Microsoft.SemanticKernel.AI.OpenAI.Clients.AzureOpenAIClientAbstract.GetDeploymentNameAsync(String modelId) at Microsoft.SemanticKernel.AI.OpenAI.Services.AzureTextEmbeddings.GenerateEmbeddingsAsync(IList1 data)
at Microsoft.SemanticKernel.AI.Embeddings.EmbeddingGeneratorExtensions.GenerateEmbeddingAsync[TValue,TEmbedding](IEmbeddingGenerator2 generator, TValue value) at Microsoft.SemanticKernel.Memory.SemanticTextMemory.SaveInformationAsync(String collection, String text, String id, String description, CancellationToken cancel) at Submission#6.<<Initialize>>d__0.MoveNext() --- End of stack trace from previous location --- at Microsoft.CodeAnalysis.Scripting.ScriptExecutionState.RunSubmissionsAsync[TResult](ImmutableArray1 precedingExecutors, Func2 currentExecutor, StrongBox1 exceptionHolderOpt, Func2 catchExceptionOpt, CancellationToken cancellationToken)

[craigomatic]

Hi! Thank you for taking a look at our samples :)

Could you provide a little more info on your setup? Are you using the Polyglot extension with VSCode to run the notebook?

[shawndengucf]

Thank you for your reply! I installed .net 7 and the SK package, and then run the notebooks (https://github.com/microsoft/semantic-kernel/tree/main/samples/notebooks/dotnet) via Jupyter. I keep all default configs and input my endpoint url and my api key. What I try to accomplish now is barely to run the notebooks locally.

[dluc]

just guessing, this can happen with proxies/MITM tools. Are you using something like Fiddler to inspect the HTTP traffic, e.g. when the kernel talks to the LLM models? SK uses SSL certs validation, so if you're using a local proxy, depending on the tool used, you might have to configure your system to trust the tool/allow MITM. I hope that helps

[shawndengucf]

Thank you for your reply! I believe you are on the right track. It must be the proxy settings that causing the trouble since I'm using the MacBook from my employer. Could you please provide more details on how to "configure your system to trust the tool/allow MITM"?

Sadly I'm not sure what tool was integrated to inspect the HTTP traffic. Normally, to solve SSL errors, I will provide the proxy (HTTP and HTTPS) address in the program, or provide the credential certificate.

I've tried below solutions but no luck so far:

1. dotnet dev-certs https --trust
2. HttpClient.DefaultProxy = new WebProxy {// my local proxy}

[dluc]

It's hard saying exactly what the steps would be, there are too many ways to configure/filter/monitor the network, from local tools like Fiddler to company wide proxy settings. Those settings are most likely in place to protect you and your employer, so I would recommend not working around them without talking to your IT dept.
Although the error message is quite clear ("The remote certificate is invalid because of errors in the certificate chain: RevocationStatusUnknown"), aside from proxies, similar errors can occur if the system clock is not up to date, or if the system itself needs to be upgraded to have up to date cert authorities.
In any case, it might be worth trying on a different machine, e.g a personal laptop, to see if the problem persists.

[shawndengucf]

Understood. Is there any way to configure the proxy/certificate while initialing/building the kernel, or while calling the api via, say, kernel.RunAsync? Thanks again!

[dluc]

I believe so but I don't have a code example right now to share. I would look into the kernel builder http factory, and start from there to inject a different HTTP logic. I haven't tried myself, and if it doesn't work we can surely make it possible. /cc @lemillermicrosoft

[anthonypuppo]

It's because CheckCertificateRevocationList is enabled on the default http client handler.

semantic-kernel/dotnet/src/InternalUtilities/src/Http/NonDisposableHttpClientHandler.cs

Line 14 in 4a2cf70

this.CheckCertificateRevocationList = true;

You'll need to pass your own HttpClient instance (example here).

[abhinpai]

Initialize your own HttpClient and use that in the Kernel

 var handler = new HttpClientHandler();
 handler.CheckCertificateRevocationList = false;
 var client = new HttpClient(handler);

 var builder  = new KernerBuilder
                .WithOpenAITextEmbeddingGenerationService(modelEmbedding, apikey, httpClient: client)
                .WithOpenAIChatCompletionService(modelCompletion, apikey, httpClient: client);