Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Web page fetch retries a non-transient TLS validation failure until it gives up (remote cert NotTimeValid)

Closed
  • Is something wrong?
#5,910 4 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
csharp
Domain
backend, networking

Research direction

Start at MeshWeaver.AI.Plugins.WebSearchPlugin.FetchWebPageCore and locate the Standard-Retry resilience-pipeline configuration; the issue notes that the plugin source was not locatable in the readable mesh. Check which exceptions the pipeline treats as retryable, using the reported AuthenticationException for a NotTimeValid certificate as the case to investigate. Done means non-transient TLS validation failures are not retried; verify with relevant resilience-pipeline tests, though none are named in the issue.

Written by the indexing model from the issue text.

Description

bug sev:L

What is failing

The WebSearchPlugin's web-page fetch (running behind the Standard-Retry Polly pipeline) cannot establish TLS to www.unternehmensindex.ch: the remote server presents a certificate that is NotTimeValid, so every attempt fails at the handshake and the fetch ultimately fails.

Probable cause

High confidence that the immediate trigger is external: the remote site's certificate is expired (or not yet valid), which the TLS chain validation correctly reports. This is not our own ingress/cert-manager story — no roll, restart or ingress change correlates with the event, and only this one external host is affected.

There is a genuine defect on our side, though: the Standard-Retry pipeline retries the System.Security.Authentication.AuthenticationException as if it were transient. A NotTimeValid chain error is deterministic — retrying it three times (the sample shows attempt 3, all handled) cannot succeed and just adds latency and fail-level log noise. Non-transient TLS validation failures should be classified as non-retryable by the resilience pipeline.

Impact

Minimal: 1 occurrence, 1 pod, 1 URL (a company-registry page on unternehmensindex.ch). Only fetches of that one external site fail until their certificate is renewed; web search over other sources keeps working. If the external-cert explanation is deemed acceptable behaviour for the fetch path, this can be closed as wontfix after the retry-classification point is considered.

Where to look

Start at MeshWeaver.AI.Plugins.WebSearchPlugin.FetchWebPageCore (top frame on the sibling incident for the same underlying failure) and the Standard-Retry resilience pipeline configuration that decides which exceptions are retryable. The plugin source was not locatable in the readable mesh, so no mesh link is given.

Duplicates / related

Sibling incident Admin/_LogIncident/f1fe69ef875c9d95 (category MeshWeaver.AI.Plugins.WebSearchPlugin) is the same fetch at the same timestamp, seen at the plugin's own log site rather than through the Polly retry logger — the two are one event and one ticket-worth of work.

Evidence
Fingerprint 0501dce7eab984c5
Category Polly
Severity Error
Exception System.Net.Http.HttpRequestException
Namespace memex
Pods memex-portal-deployment-855468d589-fxz6p
Occurrences 1
First seen 2026-09-30 05:53:00Z
Last seen 2026-09-30 05:53:00Z
Routing not determined — no configured route matches the category Polly. This repository is the configured fallback, not a finding about who owns the fault; the category names the LOGGER, which may not be the subject.
Recent log lines 
2026-09-30 05:53:00Z memex-portal-deployment-855468d589-fxz6p fail: Polly[3]
      Execution attempt. Source: '-standard/(unnamed)/Standard-Retry', Operation Key: '', Result: 'The SSL connection could not be established, see inner exception.', Handled: 'True', Attempt: '3', Execution Time: 117.1698ms
      System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
       ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: NotTimeValid
         at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan`1 alert, ExceptionDispatchInfo exception)
         at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
         at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         --- End of inner exception stack trace ---
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
         at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionWaiter`1.WaitForConnectionWithTelemetryAsync(HttpReques…[truncated]

Opened automatically from Admin/_LogIncident/0501dce7eab984c5. Recurrences are folded into this issue rather than opening new ones.
It also stands for the whole log site 1108a4f93af857df: other fingerprints of this site fold in here as comments rather than opening tickets of their own.

Dominant language
C#
Stars
12
Forks
5
Avg merge
4h 24m
Merged PRs (30d)
961

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Systemorph/MeshWeaver

All issues in Systemorph/MeshWeaver

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.