Cannot determine the frame size or a corrupted frame was received.

Same text in .NET Core, .NET 5–10 and .NET Framework. HttpClient wraps it in "The SSL connection could not be established, see inner exception."

.NET SslStream / HttpClient — AuthenticationException when the peer's reply is not a TLS record

What it means

SslStream expected a TLS record header and got bytes that do not form one, so it cannot even tell how long the next frame is. The peer is not speaking TLS on that port — typically a plain-HTTP endpoint ("HTTP/1.1 400 …") reached with https://, or a protocol that starts in plain text.

Why it happens

• https:// with a plain-HTTP port

  common

  Calling the HTTP port of a service (or a sidecar, metrics or health port) with an https:// URL.

• Kestrel listens with HTTP on the port you use

  common

  launchSettings.json or ASPNETCORE_URLS configures http:// on the port the client treats as HTTPS, a frequent mix-up between the 5xxx and 7xxx development ports.

• A plain proxy configured as TLS

  occasional

  An https:// proxy address for a proxy that only accepts plain HTTP from clients.

How to fix it

1. 1.

   Check what the port speaks

   If plain HTTP answers, use the HTTPS port or http://.

   curl -si http://api.example.com:8080/ | head -1    # answers over plain HTTP?

2. 2.

   Use the HTTPS URL Kestrel listens on

   Check applicationUrl or ASPNETCORE_URLS and call the https:// address with its port.

   {
     "profiles": {
       "https": {
         "commandName": "Project",
         "applicationUrl": "https://localhost:7001;http://localhost:5001"
       }
     }
   }

3. 3.

   Mail: STARTTLS ports need STARTTLS

   With MailKit use SecureSocketOptions.StartTls on 587 and SslOnConnect only on 465.

   // MailKit: STARTTLS on 587, implicit TLS (SslOnConnect) on 465
   await smtp.ConnectAsync("mail.example.com", 587, MailKit.Security.SecureSocketOptions.StartTls);

← Browse the full signature error database