Web page fetch retries a non-transient TLS validation failure until it gives up (remote cert NotTimeValid)

Chiusa
  • Qualcosa non va?
#5,910 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
csharp
Ambito
backend, networking

Direzione di ricerca

Start at MeshWeaver.AI.Plugins.WebSearchPlugin.FetchWebPageCore and locate the Standard-Retry resilience-pipeline configuration; the issue notes that the plugin source was not locatable in the readable mesh. Check which exceptions the pipeline treats as retryable, using the reported AuthenticationException for a NotTimeValid certificate as the case to investigate. Done means non-transient TLS validation failures are not retried; verify with relevant resilience-pipeline tests, though none are named in the issue.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug sev:L

What is failing

The WebSearchPlugin's web-page fetch (running behind the Standard-Retry Polly pipeline) cannot establish TLS to www.unternehmensindex.ch: the remote server presents a certificate that is NotTimeValid, so every attempt fails at the handshake and the fetch ultimately fails.

Probable cause

High confidence that the immediate trigger is external: the remote site's certificate is expired (or not yet valid), which the TLS chain validation correctly reports. This is not our own ingress/cert-manager story — no roll, restart or ingress change correlates with the event, and only this one external host is affected.

There is a genuine defect on our side, though: the Standard-Retry pipeline retries the System.Security.Authentication.AuthenticationException as if it were transient. A NotTimeValid chain error is deterministic — retrying it three times (the sample shows attempt 3, all handled) cannot succeed and just adds latency and fail-level log noise. Non-transient TLS validation failures should be classified as non-retryable by the resilience pipeline.

Impact

Minimal: 1 occurrence, 1 pod, 1 URL (a company-registry page on unternehmensindex.ch). Only fetches of that one external site fail until their certificate is renewed; web search over other sources keeps working. If the external-cert explanation is deemed acceptable behaviour for the fetch path, this can be closed as wontfix after the retry-classification point is considered.

Where to look

Start at MeshWeaver.AI.Plugins.WebSearchPlugin.FetchWebPageCore (top frame on the sibling incident for the same underlying failure) and the Standard-Retry resilience pipeline configuration that decides which exceptions are retryable. The plugin source was not locatable in the readable mesh, so no mesh link is given.

Duplicates / related

Sibling incident Admin/_LogIncident/f1fe69ef875c9d95 (category MeshWeaver.AI.Plugins.WebSearchPlugin) is the same fetch at the same timestamp, seen at the plugin's own log site rather than through the Polly retry logger — the two are one event and one ticket-worth of work.

Evidence
Fingerprint 0501dce7eab984c5
Category Polly
Severity Error
Exception System.Net.Http.HttpRequestException
Namespace memex
Pods memex-portal-deployment-855468d589-fxz6p
Occurrences 1
First seen 2026-09-30 05:53:00Z
Last seen 2026-09-30 05:53:00Z
Routing not determined — no configured route matches the category Polly. This repository is the configured fallback, not a finding about who owns the fault; the category names the LOGGER, which may not be the subject.
Recent log lines 
2026-09-30 05:53:00Z memex-portal-deployment-855468d589-fxz6p fail: Polly[3]
      Execution attempt. Source: '-standard/(unnamed)/Standard-Retry', Operation Key: '', Result: 'The SSL connection could not be established, see inner exception.', Handled: 'True', Attempt: '3', Execution Time: 117.1698ms
      System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
       ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: NotTimeValid
         at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan`1 alert, ExceptionDispatchInfo exception)
         at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
         at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         --- End of inner exception stack trace ---
         at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionPool.InjectNewHttp11ConnectionAsync(QueueItem queueItem)
         at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
         at System.Net.Http.HttpConnectionWaiter`1.WaitForConnectionWithTelemetryAsync(HttpReques…[truncated]

Opened automatically from Admin/_LogIncident/0501dce7eab984c5. Recurrences are folded into this issue rather than opening new ones.
It also stands for the whole log site 1108a4f93af857df: other fingerprints of this site fold in here as comments rather than opening tickets of their own.

Lingua principale
C#
Stelle
12
Fork
5
Merge medio
5h 10m
PR unite (30g)
981

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Systemorph/MeshWeaver

Tutte le issue di Systemorph/MeshWeaver

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.