On-premises data gateway & Power platform connector don't work with HTTPS ASP.NET NET Core App

[Julio_Trujillo]

Hi All

I have an Azure VM with Windows Server 2019 Datacenter in which I have hosted into IIS an ASP.NET Core REST application acting as a custom connector functionality provider; It has been working without any problem invoking it from my custom Power platform connector, using HTTP or HTTPS. Important note: When I use HTTPS on IIS I'm using a certificate signed by an Authority (in other words I'm not using the self-signed certificate provided by IIS)

I decided to test my solution using the gateway.

The gateway works perfectly if I set up the "HTTP" in my custom connector and remove the HTTPS on IIS.

But the problem comes when I turn on the HTTPS on the custom connector server side and enable again HTTPS on IIS, having this error on the Power platform side:

Headers:
{
"cache-control": "no-cache,no-store",
"content-length": "441",
"content-type": "application/json; charset=utf-8",
"date": "Tue, 13 Feb 2024 09:36:55 GMT",
"expires": "-1",
"pragma": "no-cache",
"strict-transport-security": "max-age=31536000; includeSubDomains",
"x-content-type-options": "nosniff",
"x-frame-options": "DENY",
"x-ms-apihub-cached-response": "true",
"x-ms-apihub-obo": "false",
"x-ms-connection-gateway-object-id": "f70c4cee-494d-484e-bffd-aff9f129d7f6",
"x-ms-request-id": "9fbe8420-0a6c-4434-b52d-9b0c9a665b22"
}

Body:
{
"message": "Received error payload from gateway service with ID 213252: <ccon>An error occurred while sending the request.</ccon>.\r\nclientRequestId: 9fbe8420-0a6c-4434-b52d-9b0c9a665b22",
"status": 500,
"error": {
"message": "Received error payload from gateway service with ID 213252: <ccon>An error occurred while sending the request.</ccon>."
},
"source": "gatewayconnector-we.azconn-we-002.p.azurewebsites.net"
}

Going to my host Azure server, I have extracted this information from the gateway logs:
DM.EnterpriseGateway Error: 0 : 2024-02-13T09:36:56.3038534Z DM.EnterpriseGateway d73a1464-62e9-413f-9362-5abf44358727 00000000-0000-0000-0000-000000000000 MDSR 00000000-0000-0000-0000-000000000000 cf3e7910-b177-483c-a26b-dfc40104a2c0 667f57a9-bdce-44d2-a4ee-f32b573719c2 3A0EA094 [DM.Pipeline.ExceptionUtils] EnsureGatewayPipelineException encountered a non-GatewayPipelineException: System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)
--- End of inner exception stack trace ---
at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
at System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)
--- End of inner exception stack trace ---

My Azure server has opened at azure firewall level the ports 80 & 443, as well as as Windows Firewall Level

Can anyone help me with this problem?

[Julio_Trujillo · Accepted solution]

Hi All

I found where was my problem, and definitely wanted to share it with all of you

The error is saying there is a problem SSL/TL, but really means a "certificate problem"

I found this post Stack Overflow: RemoteCertificateNameMismatch error on .NET Core API in Kubernetes with AzureAD Auth in which the author says:

... Use a fully qualified domain name ...

And I remembered my connector configuration:

I typed there the internal IP address thinking the gateway needed to know what was my server of my Azure sub-network was working with the gateway as well as having the IIS instance.
But as the author of the post says, it is necessary to specify the complete domain name in order to know what is the certificate to choose from the Windows cert store.

So making this little bit change it worked for me:

Hope this helps the community members!

Bests, Julio.