cert error in Aws lambda .net core 6 upgrade to 8

[sajanmje]

We are currently in the process of upgrading our AWS Lambda from .NET Core 6 to 8. We have built an AWS Lambda layer containing all the necessary certifications. However, after migrating the AWS Lambda, we encountered a certification error when calling the service. Interestingly, the same certificate works perfectly fine in .NET Core 6.
error:
2024-04-17T20:14:50.475Z e469d05b-8ef6-4e25-9c6f-e6e04805c0dc fail System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot
at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan1 alert, ExceptionDispatchInfo exception) at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions) at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken) at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) --- End of inner exception stack trace --- at System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(SslClientAuthenticationOptions sslOptions, HttpRequestMessage request, Boolean async, Stream stream, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(QueueItem queueItem) at System.Threading.Tasks.TaskCompletionSourceWithCancellation1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at Microsoft.Extensions.Http.Logging.LoggingHttpMessageHandler.g__Core|5_0(HttpRequestMessage request, Boolean useAsync, CancellationToken cancellationToken)
at Microsoft.Extensions.Http.Logging.LoggingScopeHttpMessageHandler.g__Core|5_0(HttpRequestMessage request, Boolean useAsync, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at Amazon.Lambda.RuntimeSupport.HandlerWrapper.<>c__DisplayClass8_0.b__0(InvocationRequest invocation) in /src/Repo/Libraries/src/Amazon.Lambda.RuntimeSupport/Bootstrap/HandlerWrapper.cs:line 54
at Amazon.Lambda.RuntimeSupport.LambdaBootstrap.InvokeOnceAsync(CancellationToken cancellationToken) in /src/Repo/Libraries/src/Amazon.Lambda.RuntimeSupport/Bootstrap/LambdaBootstrap.cs:line 185

[normj]

The major difference in .NET 8 that could be causing your trouble is .NET 8 uses Amazon Linux 2023 which has OpenSSL 3 versus .NET 6 used Amazon Linux 2 and OpenSSL 1. How are you telling the system to use the certs from the layer?

[sajanmje]

Just an assumption. Is there any way to verify it?. because it's working in .net 6

[normj]

You could see if you can recreate the scenario as a self contained published Lambda function. And then deploy the self contained deployment bundle to the .NET 8 managed runtime and .NET 6 managed runtime. Since project is self contained it doesn't care about the .NET version installed in the managed runtime but would exercise the differences in the system libraries.

[sajanmje]

I am getting below error while publish code. include required property. having handler name : ASSEMBLY::TYPE::METHOD.
command used to publish code: dotnet publish --self-contained true --runtime linux-x64 --configuration Release --output ./publish
https://github.com/aws/aws-lambda-dotnet/blob/master/Blueprints/BlueprintDefinitions/vs2022/EmptyFunction/template/src/BlueprintBaseName.1/BlueprintBaseName.1.csproj#L6

Error: .NET binaries for Lambda function are not correctly installed in the /var/task directory of the image when the image was built. The /var/task directory is missing the required .deps.json file. INIT_REPORT Init Duration: 19.36 ms Phase: init Status: error Error Type: Runtime.ExitError Error: .NET binaries for Lambda function are not correctly installed in the /var/task directory of the image when the image was built. The /var/task directory is missing the required .deps.json file. INIT_REPORT Init Duration: 44.73 ms Phase: invoke Status: error Error Type: Runtime.ExitError START RequestId: 6acc27d4-8196-435a-8683-d20d23b193ed Version: $LATEST RequestId: 6acc27d4-8196-435a-8683-d20d23b193ed Error: Runtime exited with error: exit status 105 Runtime.ExitError END RequestId: 6acc27d4-8196-435a-8683-d20d23b193ed REPORT RequestId: 6acc27d4-8196-435a-8683-d20d23b193ed Duration: 63.42 ms Billed Duration: 64 ms Memory Size: 256 MB Max Memory Used: 3 MB

[normj]

The .NET feature self contained only works when publishing executables not class libraries. The Empty Function blueprint creates a project as a class library. The Empty Top-Level Function blueprint is an executable where you can see it has the Lambda bootstrap code.

await LambdaBootstrapBuilder.Create(handler, new DefaultLambdaJsonSerializer())
        .Build()
        .RunAsync();

When you deploy a Lambda function as an executable like the Empty Top-Level Function blueprint does the handler is set to just the assembly name.