The optimization done in dotnet/corefx#25646 is risky per OpenSsl documentation: The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, or SSL_get_error() will not work reliably.. We have fixed various locations in which CoreFX code was leaving errors on the SSL error queue, but it is possible that some locations were missed, and also 3rd party libraries may interact with OpenSsl leaving errors on the queue.
Adding a config is an escape valve in case the optimization of removing the calls to ERR_clear_error() for each SSL_write/SSL_read causes troubles. There will be a performance impact but depending on the scenario it can be a desired trade-off.
PR dotnet/corefx#29186 addresses the issue in 2.2.
The optimization done in dotnet/corefx#25646 is risky per OpenSsl documentation: The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, or SSL_get_error() will not work reliably.. We have fixed various locations in which CoreFX code was leaving errors on the SSL error queue, but it is possible that some locations were missed, and also 3rd party libraries may interact with OpenSsl leaving errors on the queue.
Adding a config is an escape valve in case the optimization of removing the calls to ERR_clear_error() for each SSL_write/SSL_read causes troubles. There will be a performance impact but depending on the scenario it can be a desired trade-off.
PR dotnet/corefx#29186 addresses the issue in 2.2.