SystemWebAdapters v2.0.0 - The SSL connection could not be established - The requested function is not supported

[kristofdc]

We are using system web adapters v2.0.0 in our old webclient (.NET 4.8.1 - asp.net mvc 5) and new webclient (.NET 9 asp.net core mvc) during migration to .NET 9.0

The new client is configured with BackchannelHandler to connect to the old client as client. (+ data protection keys.xml is stored in azure blob storage)
In azure the app service is configured with minTlsVersion = 1.3

            .AddRemoteAppClient(options =>
            {
                // Core app will communicate with legacy app
                options.RemoteAppUrl = new Uri(oldWebClientUri);
                options.ApiKey = systemWebAdaptersApiKey;

                // Configure HttpClient to support TLS 1.2/1.3 for communication with old .NET Framework 4.8.1 webclient
                options.BackchannelHandler = new SocketsHttpHandler()
                {
                    SslOptions = new System.Net.Security.SslClientAuthenticationOptions
                    {
                        // Support both TLS 1.2 and 1.3 (old webclient supports 1.2, new supports 1.3)
                        // old webclient has minTlsVersion = 1.2
                        EnabledSslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13
                    }
                };
            })

The old client is configured in in global.asax.cs (+ data protection keys.xml is stored in azure blob storage)
In azure the app service is configured with minTlsVersion = 1.2

            this.AddSystemWebAdapters()
              .AddJsonSessionSerializer(options =>
              {
                  options.RegisterKey<string>("MachineName");
                  options.RegisterKey<DateTime>("SessionStartTime");
              })
              .AddProxySupport(options =>
              {
                  options.UseForwardedHeaders = true;
              })
              .AddRemoteAppServer(options =>
              {
                  // act as server to share info with ASP.NET Core app
                  options.ApiKey = ConfigurationManager.AppSettings["RemoteAppApiKey"];
              })
              .AddAuthenticationServer() // For authentication sharing
              .AddSessionServer(); // For session sharing

Locally it works, but in my deployed azure app services I fail to establish the SSL connection while accessing remote session on app startup:
{"The SSL connection could not be established, see inner exception."} - SecureConnectionError
The requested function is not supported

(source = System.Net.Http)
at System.Net.Http.ConnectHelper.d__2.MoveNext()
at System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable1.ConfiguredValueTaskAwaiter.GetResult() at System.Net.Http.HttpConnectionPool.<ConnectAsync>d__51.MoveNext() at System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable1.ConfiguredValueTaskAwaiter.GetResult()
at System.Net.Http.HttpConnectionPool.d__101.MoveNext()
at System.Threading.Tasks.TaskCompletionSourceWithCancellation1.<WaitWithCancellationAsync>d__1.MoveNext() at System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable1.ConfiguredValueTaskAwaiter.GetResult()
at System.Net.Http.HttpConnectionWaiter1.<WaitForConnectionWithTelemetryAsync>d__6.MoveNext() at System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable1.ConfiguredValueTaskAwaiter.GetResult()
at System.Net.Http.HttpConnectionPool.d__50.MoveNext()
at System.Net.Http.DiagnosticsHandler.d__10.MoveNext()
at System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable`1.ConfiguredValueTaskAwaiter.GetResult()
at System.Net.Http.RedirectHandler.d__4.MoveNext()
at System.Net.Http.HttpClient.<g__Core|83_0>d.MoveNext()
at Microsoft.AspNetCore.SystemWebAdapters.SessionState.RemoteSession.SingleConnectionWriteableRemoteAppSessionStateManager.d__1.MoveNext()
at Microsoft.AspNetCore.SystemWebAdapters.SessionState.RemoteSession.RemoteAppSessionStateManager.d__16.MoveNext()
at Microsoft.AspNetCore.SystemWebAdapters.SessionState.RemoteSession.RemoteAppSessionDispatcher.d__7.MoveNext()
at Microsoft.AspNetCore.SystemWebAdapters.SessionLoadMiddleware.d__7.MoveNext()
at Microsoft.AspNetCore.SystemWebAdapters.PreBufferRequestStreamMiddleware.d__2.MoveNext()
at Microsoft.AspNetCore.Session.SessionMiddleware.d__8.MoveNext()
at Microsoft.AspNetCore.Session.SessionMiddleware.d__8.MoveNext()
at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddlewareImpl.<g__Awaited|10_0>d.MoveNext()

Any idea what i am doing wrong or I miss some configuration settings on old or new webclient side?

[twsouthwick]

The new client is configured with BackchannelHandler to connect to the old client as client. (+ data protection keys.xml is stored in azure blob storage)

Can you help me understand why this is needed?

Can you access the same server via other means? Or does it error out as well?

[kristofdc]

We now configured a custom domain on our azure app service and now the SSL error disappeared.
But after authentication in the old client, the client is not redirected to the new client.

So at this moment we have implemented the redirect to the new client by ourself to make sure we have a workaround.
But I expected that the system web adapters does the redirect after authentication.

Locally it works as expected in documentation, but apparently not in azure. Also logging does not tell anything useful.