Api random call fails - The request was aborted: Could not create SSL/TLS secure channel

Question

We have an eCommerce site that calls our own API (Web Api sat on a windows 2008 server + IIS) to move order from online to an on premise system.

The Api was working fine for months but now we are getting random errors which our logs are reporting as "The request was aborted: Could not create SSL/TLS secure channel."

The code will work ok for 24 hours or so and then fail, every call after will then fail. We then restart the eCommerce site (its hosted in Azure, so we restart the instance). Once the site has been restarted the calls to the Api start working again.

We are using Restsharp to call the Api.

We have looked into the certificates, etc and these seem fine (it also doesn't explain why sometimes it works ok).

At around the same time as it started failing we introduced a new plugin on the eCommerce site which uses the Amazon C# client to pull orders from Amazon into the eCommerce site.

The procedures run on a schedule task every hour or so.

Could this issue be around some sort of IIS caching? Maybe around amazon requiring a different version of TLS to our Api hosted on a win 2008 server?

Pillory

Just a hunch (been there before). Might your new plugin set or override the static certificate validation callback at some point? ServicePointManager.ServerCertificateValidationCallback (msdn.microsoft.com/en-us/library/…) – Iyar

Did anyone figure out how to solve this? I'm also getting this issue randomly. – Broncho

Answer 1

The code will work ok for 24 hours or so and then fail, every call after will then fail. We then restart the eCommerce site (its hosted in Azure, so we restart the instance). Once the site has been restarted the calls to the Api start working again.

I think you have problems with time.
You need correct time on server/client to create SSL/TSL secure channel.
It seems that when you're restarting your site - time is synchronizing and in 24hr it gets unsynchronized again for some reason. Try to look into that direction.

Hornbeck

Answer 2

The code will work ok for 24 hours or so and then fail

Probably the SSL signature expires after 24 hours. Reference from https://mcmap.net/q/1321030/-azure-api-management-rest-api-calls-suddenly-fail.

Algae