Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

WebSearchPlugin fails a page fetch when the external site's TLS certificate is invalid

Closed
  • Is something wrong?
#5,912 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
csharp
Domain
backend

Research direction

Start with src/MeshWeaver.AI/Plugins/WebSearchPlugin.cs, especially FetchWebPageCore and the fetch block near line 186; compare the handling there with the behavior discussed in #1561. Check whether that issue's fix covers TLS and other transport failures per result. Done when a failed external fetch is skipped without aborting the search, while certificate validation remains enabled.

Written by the indexing model from the issue text.

Description

bug sev:L

What is failing

WebSearchPlugin.FetchWebPageCore (the AI web-search page-fetch helper) aborts and logs a fail when the external page it fetches has an invalid TLS certificate. The remote server's certificate chain fails validation (NotTimeValid — an expired or not-yet-valid certificate), the TLS handshake is refused, and the fetch of that search result fails outright instead of being skipped gracefully.

Probable cause

The plugin fetches arbitrary external URLs returned by search results and lets transport-level HttpRequestExceptions from the HttpClient bubble up as hard failures rather than treating a dead or broken remote site as a benign, per-result condition. The certificate rejection itself is correct behaviour — the remote site genuinely serves an invalid certificate chain — the defect is that FetchWebPageCore doesn't degrade per-result. Confidence: high on the mechanism (the inner AuthenticationException names NotTimeValid explicitly and the stack runs entirely through the HttpClient connect/handshake path); the framing as a defect assumes the plugin is meant to tolerate unreachable results, which is how #1561 was already ruled.

This is the same defect class as #1561 (filed for 404s and DNS failures at this exact log site): FetchWebPageCore fails on any problematic external page instead of handling it per-result. Please link/close as a duplicate if #1561's fix is intended to cover all fetch failure modes.

Impact

Low. Single occurrence, one pod, within one minute. A single AI web-search page fetch was aborted; the site in question is a third-party registry page whose certificate has expired — nothing on our side is broken and the search flow can continue with other results. If it recurs across many distinct hosts, that would indicate the plugin is logging routine external breakage at fail level and drowning out real incidents.

Where to look

  • File: src/MeshWeaver.AI/Plugins/WebSearchPlugin.cs, method FetchWebPageCore (the <FetchWebPageCore>b__0 lambda in the stack trace; the EnsureSuccessStatusCode/fetch block around line 186 per the #1561 evidence)
  • Fix pattern: the same per-result error handling proposed in #1561 — catch transport failures (DNS, 4xx/5xx, TLS/certificate errors) per fetched URL, log at debug/information, and skip the result so the search continues.
Evidence
Fingerprint f1fe69ef875c9d95
Category MeshWeaver.AI.Plugins.WebSearchPlugin
Severity Error
Exception System.Net.Http.HttpRequestException
Top frame MeshWeaver.AI.Plugins.WebSearchPlugin.<>c__DisplayClass14_0.<<FetchWebPageCore>b__0>d.MoveNext()
Namespace memex
Pods memex-portal-deployment-855468d589-fxz6p
Occurrences 1
First seen 2026-09-30 05:53:00Z
Last seen 2026-09-30 05:53:00Z
Routing not determined — no configured route matches the category MeshWeaver.AI.Plugins.WebSearchPlugin. This repository is the configured fallback, not a finding about who owns the fault; the category names the LOGGER, which may not be the subject.
Recent log lines 
2026-09-30 05:53:00Z memex-portal-deployment-855468d589-fxz6p fail: MeshWeaver.AI.Plugins.WebSearchPlugin[0]
      Failed to fetch web page url=https://www.unternehmensindex.ch/zh/zuerich/schenker-labs-gmbh-CHE-171-487-478/
      System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
       ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: NotTimeValid
         at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan`1 alert, ExceptionDispatchInfo exception)
         at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
         at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         --- End of inner exception stack trace ---
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
         at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionWaiter`1.WaitForConnectionWithTelemetryAsync(HttpRequestMessage request, HttpConnectionPool pool, Boolean async, CancellationToken re…[truncated]

Opened automatically from Admin/_LogIncident/f1fe69ef875c9d95. Recurrences are folded into this issue rather than opening new ones.
It also stands for the whole log site a4b2b983d01b440d: other fingerprints of this site fold in here as comments rather than opening tickets of their own.

Dominant language
C#
Stars
12
Forks
5
Avg merge
4h 19m
Merged PRs (30d)
932

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Systemorph/MeshWeaver

All issues in Systemorph/MeshWeaver

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.