Received an unexpected EOF or 0 bytes from the transport stream.

HttpClient wraps it in "The SSL connection could not be established, see inner exception." Logs from .NET Framework applications commonly show the same situation as "Authentication failed because the remote party has closed the transport stream."

.NET SslStream / HttpClient — IOException: the peer closed the connection during the TLS handshake

What it means

The remote side (or a device in between) closed the TCP connection while SslStream was in the middle of the TLS handshake, without sending a TLS alert. .NET has no reason to report beyond the closed stream. Usually the server refused the handshake silently, or a proxy or firewall dropped it.

Why it happens

• The server closes handshakes it does not accept

  common

  No common protocol version or cipher, a missing or unknown SNI name, or a server that requires something the client did not offer, with a server that closes instead of sending an alert.

• A proxy or firewall drops the connection

  common

  Networks requiring a proxy, TLS-filtering firewalls and VPN clients end blocked connections silently.

• .NET Framework applications offering only old TLS versions

  occasional

  Applications targeting .NET Framework 4.5 or older without OS-default TLS settings may offer only TLS 1.0, which modern servers drop.

How to fix it

1. 1.

   Test the handshake from the same machine

   If openssl s_client is cut off too, the problem is the network or the server; if it succeeds, compare protocol versions and SNI with the .NET client.

   # Does a plain TLS handshake from the same host work?
   openssl s_client -connect api.example.com:443 -servername api.example.com -brief </dev/null
   openssl s_client -connect api.example.com:443 -servername api.example.com -tls1_2 -brief </dev/null

2. 2.

   Use the required proxy

   Configure the proxy on the handler (or through HTTPS_PROXY on Linux) when the network does not allow direct connections.

   // Use the corporate proxy explicitly (HttpClient also honours HTTPS_PROXY / system settings)
   var handler = new SocketsHttpHandler { Proxy = new WebProxy("http://proxy.example.net:3128"), UseProxy = true };
   using var client = new HttpClient(handler);

3. 3.

   .NET Framework: enable TLS 1.2

   Retarget to 4.7 or later so the OS chooses the protocol, or add TLS 1.2 to ServicePointManager.SecurityProtocol until you can.

   // .NET Framework 4.x apps compiled for old targets may still offer only TLS 1.0:
   // target 4.7+ (OS defaults) or, as a stop-gap, enable TLS 1.2 explicitly
   System.Net.ServicePointManager.SecurityProtocol |= System.Net.SecurityProtocolType.Tls12;

← Browse the full signature error database