Ошибка вызова sspi см внутреннее исключение

I have an WPF app, which uses SSLStream to connect to server and send/receive some messages. My code is largerly based on this example (SslTcpClient): https://msdn.microsoft.com/en-us/library/system.net.security.sslstream(v=vs.110).aspx.

This worked fine for months. However, after getting this windows update (Cumulative Update for Windows 10 version 1511 and Windows Server 2016 Technical Preview 4: June 14, 2016 — https://support.microsoft.com/en-us/kb/3163018). My app started to report this exception:

System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The Local Security Authority cannot be contacted
   --- End of inner exception stack trace ---
at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
at MyAPP.Core.Services.Network.Impl.SslTcpClient.ClientSideHandshake()
at MyAPP.Core.Services.Network.Impl.SslTcpClient.Connect()
at MyAPP.Core.Services.Impl.MessageService.SendMessage(String message)

What can I do ?

I have an WPF app, which uses SSLStream to connect to server and send/receive some messages. My code is largerly based on this example (SslTcpClient): https://msdn.microsoft.com/en-us/library/system.net.security.sslstream(v=vs.110).aspx.

This worked fine for months. However, after getting this windows update (Cumulative Update for Windows 10 version 1511 and Windows Server 2016 Technical Preview 4: June 14, 2016 — https://support.microsoft.com/en-us/kb/3163018). My app started to report this exception:

System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The Local Security Authority cannot be contacted
   --- End of inner exception stack trace ---
at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Net.Security.SslStream.AuthenticateAsClient(String targetHost, X509CertificateCollection clientCertificates, SslProtocols enabledSslProtocols, Boolean checkCertificateRevocation)
at MyAPP.Core.Services.Network.Impl.SslTcpClient.ClientSideHandshake()
at MyAPP.Core.Services.Network.Impl.SslTcpClient.Connect()
at MyAPP.Core.Services.Impl.MessageService.SendMessage(String message)

What can I do ?

I had a self-hosted win service WCF installed and running at one point.

Naturally, I had to make some changes. So I changed the base address back to my local workstation and made the changes. It worked fine.

Now it’s time to redistribute and… Well… It keeps hosing and I can’t figure it out.

From the app.config file:

<system.serviceModel>
<services>
  <service behaviorConfiguration="ExStreamWCF.Service1Behavior"
    name="ExStreamWCF.Service1">
    <endpoint address="" binding="netTcpBinding" bindingConfiguration=""
      contract="ExStreamWCF.IService1">
      <identity>
        <dns value="Devexstream-2" />
        <!--<dns value="vmwin2k3sta-tn2" />-->
      </identity>
    </endpoint>
    <endpoint address="mex" binding="mexTcpBinding" bindingConfiguration=""
      contract="IMetadataExchange" />
    <host>
      <baseAddresses>
        <add baseAddress="net.tcp://Devexstream-2:8080/Service" />
        <!--<add baseAddress="net.tcp://vmwin2k3sta-tn2:8080/Service" />-->
      </baseAddresses>
    </host>
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="ExStreamWCF.Service1Behavior">
      <serviceMetadata httpGetEnabled="false" />
      <serviceDebug includeExceptionDetailInFaults="true" />
    </behavior>
  </serviceBehaviors>
</behaviors>

From the web.config file (long story):

  <system.serviceModel>
    <services>
  <service behaviorConfiguration="ExStreamWCF.Service1Behavior"
    name="ExStreamWCF.Service1">
    <endpoint address="" binding="netTcpBinding" bindingConfiguration=""
      contract="ExStreamWCF.IService1">
      <identity>
        <dns value="Devexstream-2" />
        <!--<dns value="vmwin2k3sta-tn2" />-->
      </identity>
    </endpoint>
    <endpoint address="mex" binding="mexTcpBinding" bindingConfiguration=""
      contract="IMetadataExchange" />
    <host>
      <baseAddresses>
        <add baseAddress="net.tcp://Devexstream-2:8080/Service" />
        <!--<add baseAddress="net.tcp://vmwin2k3sta-tn2:8080/Service" />-->
      </baseAddresses>
    </host>
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="ExStreamWCF.Service1Behavior">
      <serviceMetadata httpGetEnabled="false" />
      <serviceDebug includeExceptionDetailInFaults="true" />
    </behavior>
  </serviceBehaviors>
</behaviors>

Any guesses on what I’m doing wrong?

You may get the errors, «A call to SSPI failed, see inner exception» and «The certificate chain was issued by an authority that is not trusted«. While they should have no impact on your end-users, you’d still like to clean them up from the logs.

Qlik Sense otherwise functions without issues.

Example error:

System.Proxy.Qlik.Sense.Communication.Communication.Tcp.StreamFactory 16 c2972806-6ae3-4559-8ebf-c7c2201335f3 xxxxx Failed to authenticate stream as Server The client and server cannot communicate, because they do not possess a common algorithm↵↓A call to SSPI failed, see inner exception. NO-STACKTRACE↵↓ at System.Net.Security.SslState.InternalEndProcessAuthentication(LazyAsyncResult lazyResult)

These, unfortunately, are not Qlik Sense errors, but rather errors from Windows that Qlik Sense reports.  You should also be able to see them in your Windows Application logs. For more information, please search out Windows Support.

1. A possible root cause for Windows reporting these errors is a missing or wrong certificate thumbprint.

   If a third party certificate is being used in the environment, verify that the correct thumbprint is added to the Qlik Sense Proxy.

2. It may also be related to the load balancer.   

   A common behaviour for a load balancer is a quite constant interval between two SSPI failures on Sense,  generally because the basic load balances HTTPS health check doesn’t complete the HTTPS handshake.  The error «because they do not possess a common algorithm» is for this reason.  The fast check can be done by changing the frequency of HTTP health check on the load balancer and seeing the corresponding interval change on the Qlik Sense side pay attention if multiple LB nodes are present.

Microsoft.Mashup.Container.NetFX40.exe Error: 0 : A call to SSPI failed, see inner exception.

DataMashup.Trace Error: 24579 : {«Start»:»2016-09-28T14:12:45.9387300Z»,»Action»:»Engine/IO/Db/MySql/ProcessException»,»Exception»:»Exception:rnExceptionType: System.Security.Authentication.AuthenticationException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089rnMessage: A call to SSPI failed, see inner exception.rnStackTrace:n   at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)rn   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)rn   at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)rn   at MySql.Data.MySqlClient.NativeDriver.StartSSL()rn   at MySql.Data.MySqlClient.NativeDriver.Open()rn   at MySql.Data.MySqlClient.Driver.Open()rn   at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings)rn   at MySql.Data.MySqlClient.MySqlPool.CreateNewPooledConnection()rn   at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection()rn   at MySql.Data.MySqlClient.MySqlPool.TryToGetDriver()rn   at MySql.Data.MySqlClient.MySqlPool.GetConnection()rn   at MySql.Data.MySqlClient.MySqlConnection.Open()rn   at Microsoft.Mashup.Engine1.Library.Common.WrappedDbConnection.Open()rn   at Microsoft.Mashup.Engine1.Library.Common.DbExtensions.<>c__DisplayClass1.<Open>b__0()rn   at Microsoft.Mashup.Engine1.Library.Common.DbEnvironment.RunWithRetryGuard[T](Func`1 action, Func`2 retryAfterSqlError, Action finalizeOnRetry, String dataSourceNameString, IEngineHost host)rn   at Microsoft.Mashup.Engine1.Library.Common.DbEnvironment.ConvertDbExceptions[T](IResource resource, Func`1 action, Func`2 retryAfterSqlError, Action finalizeOnRetry, String dataSourceNameString, IEngineHost host)rnrnInnerExceptionrnException:rnExceptionType: System.ComponentModel.Win32Exception, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089rnMessage: The Local Security Authority cannot be contactedrnStackTrace:nrnrnrnrnrn»,»ProductVersion»:»2.38.4491.282 (PBIDesktop)»,»ActivityId»:»f244fe92-ca84-4c4c-b0f4-892802227819″,»Process»:»Microsoft.Mashup.Container.NetFX40″,»Pid»:80,»Tid»:1,»Duration»:»00:00:00.0001144«}

DataMashup.Trace Information: 24579 : {«Start»:»2016-09-28T14:12:45.6148071Z»,»Action»:»Engine/IO/Db/MySQL/RunWithRetry»,»ProductVersion»:»2.38.4491.282 (PBIDesktop)»,»ActivityId»:»f244fe92-ca84-4c4c-b0f4-892802227819″,»Process»:»Microsoft.Mashup.Container.NetFX40″,»Pid»:80,»Tid»:1,»Duration»:»00:00:00.3240824«}

DataMashup.Trace Information: 24579 : {«Start»:»2016-09-28T14:12:45.6147468Z»,»Action»:»Engine/IO/Db/MySQL/RunWithRetry»,»ProductVersion»:»2.38.4491.282 (PBIDesktop)»,»ActivityId»:»f244fe92-ca84-4c4c-b0f4-892802227819″,»Process»:»Microsoft.Mashup.Container.NetFX40″,»Pid»:80,»Tid»:1,»Duration»:»00:00:00.3241940«}