SSL/TLS authentication failure with "An unknown error occurred while processing the certificate

[lircy]

---

Description:
I've implemented a WebSocket server using Fleck, but encountering SSL/TLS authentication failures when clients attempt to connect. The server throws an AggregateException with nested AuthenticationException and Win32Exception.

Error Log:

Failed to Authenticate System.AggregateException: One or more errors occurred. ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: An unknown error occurred while processing the certificate
   --- End of inner exception stack trace ---
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Net.Security.SslStream.EndAuthenticateAsServer(IAsyncResult asyncResult)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
   --- End of inner exception stack trace ---
---> (Inner Exception #0) System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: An unknown error occurred while processing the certificate
   --- End of inner exception stack trace ---
   at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)
   at System.Net.Security.SslState.EndProcessAuthentication(IAsyncResult result)
   at System.Net.Security.SslStream.EndAuthenticateAsServer(IAsyncResult asyncResult)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)<---

Environment:

• Fleck version: 1.2
• .NET Runtime: .NetFramework4.7.2
• OS: Win10 Pro

Reproduction Steps:

1. Configure WebSocket server with SSL:

   static void Main(string[] args)
        {
            FleckLog.Level = LogLevel.Debug;
            var allSockets = new List<IWebSocketConnection>();
            var server = new WebSocketServer("wss://0.0.0.0:8181");
            server.Certificate = new X509Certificate2("test.com.pfx", "930718");
            server.EnabledSslProtocols = System.Security.Authentication.SslProtocols.Tls12;
            server.ListenerSocket.NoDelay = true;
            server.RestartAfterListenError = true;
            server.Start(socket =>
            {
                socket.OnOpen = () =>
                {
                    Console.WriteLine("Open!");
                    allSockets.Add(socket);
                };
                socket.OnClose = () =>
                {
                    Console.WriteLine("Close!");
                    allSockets.Remove(socket);
                };
                socket.OnMessage = message =>
                {
                    Console.WriteLine(message);
                    allSockets.ToList().ForEach(s => s.Send("Echo: " + message));
                };
            });
            var input = Console.ReadLine();
            while (input != "exit")
            {
                foreach (var socket in allSockets.ToList())
                {
                    socket.Send(input);
                }
                input = Console.ReadLine();
            }
        }

2. Attempt connection from WebSocket client
3. Server immediately throws the authentication exception

---

[AdrianBathurst]

Make sure you have the certificate path mapped correctly, e.g.:
server.certificate = new X509Certificate2("C:\\test.com.pfx", "your-password");

If you haven't yet, follow the instructions exactly here: #214 (comment)

I'm off grid for a while so won't be able help much.

[lircy]

Thank you

[lircy]

Based on your provided procedure, the issue has been resolved. The previous error occurred because I accessed the server directly via IP address without binding it to the domain name. Thank you very much for your assistance.

…

________________________________ 发件人: Adrian ***@***.***> 发送时间: 2025年6月23日 8:54 收件人: statianzo/Fleck ***@***.***> 抄送: lircy ***@***.***>; Author ***@***.***> 主题: Re: [statianzo/Fleck] SSL/TLS authentication failure with "An unknown error occurred while processing the certificate (Issue #349) [https://avatars.githubusercontent.com/u/9006517?s=20&v=4]AdrianBathurst left a comment (statianzo/Fleck#349)<#349 (comment)> Make sure you have the certificate path mapped correctly, e.g.: server.certificate = new X509Certificate2("C:\\test.com.pfx", "your-password"); If you haven't yet, follow the instructions exactly here: #214 (comment)<#214 (comment)> I'm off grid for a while so won't be able help much. ― Reply to this email directly, view it on GitHub<#349 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AKXJSGNXBTZH3MRMBEOF3UT3E66ERAVCNFSM6AAAAAB73CNIX6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSOJVGU2TCOBXGM>. You are receiving this because you authored the thread.Message ID: ***@***.***>