The SSL connection could not be established, see inner exception.

The text is stable across .NET Core 3.x to .NET 10. Frameworks (Refit, gRPC, Azure SDKs) may wrap it once more, so the inner exception can be two or three levels down.

.NET HttpClient — HttpRequestException wrapping the AuthenticationException or IOException of the TLS handshake

What it means

HttpClient's generic wrapper for any TLS failure while connecting. The message itself carries no diagnosis: the actual reason is in InnerException (an AuthenticationException naming the certificate problem, or an IOException from the transport). Logging only e.Message hides it; log the whole exception chain.

Why it happens

• Certificate validation failed

  common

  Untrusted or partial chains, expired certificates or a host-name mismatch: the inner AuthenticationException names the X509ChainStatus or SslPolicyErrors value.

• No common protocol or cipher

  occasional

  Legacy servers on TLS 1.0/1.1 or with outdated suites; on Linux the inner exceptions show the OpenSSL reason.

• The connection was not TLS or was cut

  occasional

  Plain-HTTP ports, proxies or firewalls closing the connection, or servers resetting the handshake.

How to fix it

1. 1.

   Log the full exception chain

   Walk InnerException (or log the exception object, not just Message) to see the real cause.

   catch (HttpRequestException e)
   {
       for (Exception? ex = e; ex != null; ex = ex.InnerException)
           logger.LogError("{Type}: {Message}", ex.GetType().FullName, ex.Message);
   }

2. 2.

   Map the inner message to its cause

   Each inner message points to a different fix; the related entries below cover them one by one.

   Inner exception                                                       -> look at
   "...errors in the certificate chain: UntrustedRoot / PartialChain"    -> trust store, server chain
   "...errors in the certificate chain: NotTimeValid"                    -> dates, clock
   "...validation procedure: RemoteCertificateNameMismatch"              -> host name vs SAN
   "Cannot determine the frame size or a corrupted frame was received."  -> port is not TLS
   "Received an unexpected EOF or 0 bytes from the transport stream."    -> server/proxy closed
   "SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL."            -> protocol/cipher (Linux)

← Browse the full signature error database