Blocking call to DownloadAsset during SSL negotiation kills Kestrel server after restart under load

[dv00d00]

Details are in another ticket in aspnetcore repo

Code under question is here

Please let me know if you would need more data

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq
Notify danmosemsft if you want to be subscribed.

[dv00d00]

If there are any workarounds around this behavior?

Does SSL Stream downloads a certificate for every request?

When this behavior is triggered? (This was happening for fullchain certificate in my case)

[bartonjs]

While this particular issue hasn't had much activity, other variants have, but I'll go ahead and address the points here (then close it).

If there are any workarounds around this behavior?

At application startup, either manually load the intermediate certificate into the intermediate CA certificate store, or successfully build a chain using X509Chain.Build(targetCert) (which will do the caching as long as the root is trusted), making everything nice and stable before opening up for activity.

Does SSL Stream downloads a certificate for every request?

SslStream asks X509Chain to build the chain so it can serve out the intermediate(s). Last week #38364 made it so that we now build the chain once in SslStream and keep it around.

When this behavior is triggered?

When building an X509Chain and the intermediate certificate authority certificate(s) are not known, then many parallel requests come in to request the chain.

---

There are also some other micro-improvements in the works, but #38364 should be the most significant gain.

[stephentoub]

I'd expect #38502 to help here, too.