An error occurred while attempting to establish an SSL or TLS connection

[dheoxic]

I am getting this error when I deploy the application on IIS on another computer.

The server's SSL certificate could not be validated for the following reasons:
• The server certificate has the following errors:
  • The revocation function was unable to check revocation for the certificate.
  • The revocation function was unable to check revocation because the revocation server was offline.
• An intermediate certificate has the following errors:
  • The revocation function was unable to check revocation for the certificate.
  • The revocation function was unable to check revocation because the revocation server was offline.

I already tried the following but the error gets thrown from time to time (email sending starts working after an hour or two)

1. client.CheckCertificateRevocation = false;
2. client.Connect("smtp-mail.outlook.com", 587, SecureSocketOptions.None/Auto/SslOnConnect/StartTLS);

Is there any way I can prevent this from happening?

[jstedfast]

What those errors mean is that .NET's SslStream implementation was unable to check the revocation status (I'm sure you figured that part out).

client.CheckCertificateRevocation = false;

I would have expected the above code snippet to have worked, but I guess it didn't for you for some reason.

The next thing I would try, would be to try implementing your own certificate validation callback. Start with something like this:

client.ServerCertificateValidationCallback = MyCertificateValidationCallback;

static bool IsUnableToCheckRevocation (X509Chain chain)
{
    foreach (var status in chain.ChainStatus) {
        if (status.Status == X509ChainStatusFlags.NoError || status.Status == X509ChainStatusFlags.OfflineRevocation || status.Status == X509ChainStatusFlags.RevocationStatusUnknown)
            continue;

        return false;
    }

    return true;
}

bool MyCertificateValidationCallback (object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    const SslPolicyErrors mask = SslPolicyErrors.RemoteCertificateNotAvailable | SslPolicyErrors.RemoteCertificateNameMismatch;

    if (sslPolicyErrors == SslPolicyErrors.None)
        return true;

    if ((sslPolicyErrors & mask) == 0) {
        // At this point, all that is left is SslPolicyErrors.RemoteCertificateChainErrors

        // If the problem is a revocation check error, then ignore it.
        if (IsUnableToCheckRevocation (chain))
            return true;
    }

    return false;
}

FYI: For the Connect() method call, port 587 should use SecureSocketOptions.StartTls (or any value other than SecureSocketOptions.SslOnConnect - SslOnConnect should only be used with port 465).

[dheoxic]

I was trying to find a way to just ignore the revocation check error and just proceed with email sending but have no means of checking since this issue happens once/twice a week only, then the email functionality resumes working after an hour or two. I will try to implement your workaround and provide a feedback if the error still persists.

Thank you.

[jstedfast]

I'll close this in the meantime, but if you hit the issue again, just give me a poke and I'll do what I can to help you get past it.