Client certificate fails in validation procedure by framework on linux and docker

[raych1]

I created a new project base on aspnet core web application API template target on asp.net core 3.1 and enable client certificate authentication as below. It works when running with IISExpress or dotnet exe, the browser will prompt to pick up a certificate to proceed. However, it failed when debug with docker in visualstudio. When send the request of https://localhost:32834/weatherforecast/ in browser of host machine, kestrel server terminates the request as ERR_CONNECTION_CLOSED. It fails in TLS negotiation, looks like it's different validation policy in framework for linux and windows. Can I ignore the certificate validation in framework and do it in middleware?

This is the error I got when use same certificate to send the request:

Exception thrown: 'System.Security.Authentication.AuthenticationException' in System.Private.CoreLib.dll: 'The remote certificate is invalid according to the validation procedure.'
Stack trace:
 >   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() in /_/src/System.Private.CoreLib/shared/System/Runtime/ExceptionServices/ExceptionDispatchInfo.cs:line 63

        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        }

        public static IHostBuilder CreateHostBuilder(string[] args) =>
            Host.CreateDefaultBuilder(args)
                .ConfigureWebHostDefaults(webBuilder =>
                {
                    webBuilder.CaptureStartupErrors(true);
                    webBuilder.UseStartup<Startup>();
                    webBuilder.ConfigureKestrel(o =>
                    {
                        o.ConfigureHttpsDefaults(o =>
                            {
                                o.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
                                o.ServerCertificate = new X509Certificate2("xxx.pfx", string.Empty);
                            });
                    });
                    webBuilder.UseUrls("https://+:5003");
                });

[Tratcher]

Can I ignore the certificate validation in framework and do it in middleware?

Yes, add a call to o.AllowAnyClientCertificate() in ConfigureHttpsDefaults.
https://github.com/dotnet/aspnetcore/blob/aa828180783b6245cdab2cba7d59d91396eaa01b/src/Servers/Kestrel/Core/src/HttpsConnectionAdapterOptions.cs#L84