X.509 Chain Building Failed when connecting to the AppFabric

Question

Writing a test application for my AppFabric-based library, I started getting a strange exception.

The X.509 certificate CN=servicebus.appfabriclabs.com chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. The revocation function was unable to check revocation because the revocation server was offline.

I've tried with next configuration with no success

<behaviors>
 <endpointBehaviors>
  <behavior name="SecureMessageUserName">
   <clientCredentials>
     <serviceCertificate>
        <authentication revocationMode="NoCheck"/>
     </serviceCertificate>
   </clientCredentials>
  </behavior>
 </endpointBehaviors>
</behaviors>

and also with ServicePointManager.CheckCertificateRevocationList set to false with no success.

Spiky

Answer 1

Surprisingly, I had the same problem not so long ago. I contacted the AppFabric team, and they confirmed nothing was wrong with the actual certificate.

After a lot of scouting around, I considered clearing the CRL, because it gets cached. I finally found the answer in a comment in a blog post.

This worked for me:

• Close Visual Studio and make sure all instances & processes related to your test applications are closed
• Open CMD with elevated priviliges, and type certutil -urlcache * delete
• I restarted the PC for good measure, but it's not necessary

Interestingly enough, this does not appear to be an AppFabric issue but something on the Windows machines. Let me know if it works.

Sourwood

As an update, here is the link to CertUtil's documentation: technet.microsoft.com/en-us/library/cc732443.aspx – Deedeeann

It is the last part of the error message that interests me. The server could be offline. What server is it trying to use? Could it be a proxy configuration issue? – Illampu

The problem (at least for us) was that when we deploy to the emulator an app pool gets created on the local IIS server. That gets created running as Network Service. Which in our company network does not have permission to access the internet. When I change this to my domain account, I no longer get this error. The problem is that every time the deploy is done, a new app pool is created so I have to do this every time. That is pretty annoying, but at least it is working now. – Illampu