Issue with CloudConnectionPool

NEST/Elasticsearch.Net version: 7.14.1 Elasticsearch version: 7.14 .NET runtime version: 5.0.400 Operating system version: 10.0.22000

Description of the problem including expected versus actual behavior: Getting following exception when I want to index or get something from cloud hosted elastic search. Error: ` Invalid NEST response built from a unsuccessful () low level call on PUT: /mytweetidx/_doc/1?pretty=true&error_trace=true Audit trail of this API call:

• [1] ProductCheckOnStartup: Took: 00:00:00.4842438
• [2] ProductCheckFailure: Node: https://xxxxxxx:9243/ Took: 00:00:00.4534002 OriginalException: Elasticsearch.Net.ElasticsearchClientException: The client is unable to verify that the server is Elasticsearch due to an unsuccessful product check call. Some functionality may not be compatible if the server is running an unsupported product. Call: Status code unknown from: GET /?pretty=true&error_trace=true —> Elasticsearch.Net.PipelineException: The client is unable to verify that the server is Elasticsearch due to an unsuccessful product check call. Some functionality may not be compatible if the server is running an unsupported product. —> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. —> System.Security.Authentication.AuthenticationException: Authentication failed because the remote party sent a TLS alert: ‘HandshakeFailure’. —> System.ComponentModel.Win32Exception (0x80090326): The message received was unexpected or badly formatted. — End of inner exception stack trace — at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm) at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Boolean async, Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken) — End of inner exception stack trace — at System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Boolean async, Stream stream, SslClientAuthenticationOptions sslOptions, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken) at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.DecompressionHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpClient.SendAsyncCore(HttpRequestMessage request, HttpCompletionOption completionOption, Boolean async, Boolean emitTelemetryStartStop, CancellationToken cancellationToken) at Elasticsearch.Net.HttpConnection.Request[TResponse](RequestData requestData) — End of inner exception stack trace — at Elasticsearch.Net.RequestPipeline.ThrowIfTransientProductCheckFailure() at Elasticsearch.Net.RequestPipeline.Ping(Node node) at Elasticsearch.Net.Transport1.Ping(IRequestPipeline pipeline, Node node) at Elasticsearch.Net.Transport1.Request[TResponse](HttpMethod method, String path, PostData data, IRequestParameters requestParameters) — End of inner exception stack trace — Request: <Request stream not captured or already read to completion by serializer. Set DisableDirectStreaming() on ConnectionSettings to force it to be set on the response.> `

Steps to reproduce:

var cloudId = "cloudId"

var crednetials = new BasicAuthenticationCredentials(user, stringPw);
var pool = new CloudConnectionPool(cloudId, crednetials);
var settings = new ConnectionSettings(pool)
    .EnableDebugMode()
    .EnableHttpCompression()
    .PrettyJson();
var client = new ElasticClient(settings);
var newTweet = new Tweet()
{
    Id = 1,
    User= "knile",
    PostDate = DateTime.Now,
    Message = "Madafaka ne radi"
};
var response = client.Index(newTweet, idx => idx.Index("mytweetidx"));
var getDoc = client.Get<Tweet>(1, idx => idx.Index("mytweetidx"));
var retrived = getDoc.Source;

Same code works on ubuntu 20.04, this looks like a underlying OS issue but I wanted to check if you have any suggestions what could cause this issue.

Thanks

[stevejgordon]

I’ve just released 7.15.1 of the NEST client which includes the temporary configuration value UnsafeDisableTls13 that can be used to disable the use of TLS1.3 by the client. I’ve tested this on Windows 11 and it resolved the handshake failure to Cloud. It can be enabled on the configuration as follows:

var credentials = new BasicAuthenticationCredentials("elastic", "password"); 
var pool = new CloudConnectionPool("CloudId", credentials); 
var esClient = new ElasticClient(new ConnectionSettings(pool).UnsafeDisableTls13());

[wfurt]

Tls13 is the culprit and disabling it should unblock anybody @knilecrack. @stevejgordon is investigating the server part as it seems to complain about ciphers even if client offers cipher suites that should be available on the server.