Send email from service fabric actor with SmtpClient fails - azure-service-fabric

Question

I am trying to send an email from a Service fabric actor method. The code is very simple and works without problem in a console application but the very same code inside the actor method generate the exception:
"The remote certificate is invalid according to the validation procedure"
I have no idea why this is happening and what I should add to my code to make it work (I don't want to bypass certificate validation or disable encryption), so I am looking for help on this forum.
Thank you
Here is my code (just replaced credentials and domain with dummy names)
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Mail;
using System.Text;
using System.Threading.Tasks;
namespace testsmtp {
class Program {
static void Main(string[] args) {
SendEmailAlert("myuserid", "mypassword", "recipient#mydomain.com", "test subject", "test body");
}
private static bool SendEmailAlert(string uid, string pwd, string recipient_list, string subject, string body) {
MailMessage msg = new MailMessage();
msg.To.Add(recipient_list);
msg.From = new MailAddress("sender#mydomain.com");
msg.Subject = subject;
msg.Body = body;
msg.IsBodyHtml = false;
SmtpClient client = new SmtpClient();
client.Host = "smtp.mydomain.com";
client.Port = 587;
client.EnableSsl = true;
client.UseDefaultCredentials = false;
client.Credentials = new NetworkCredential(uid, pwd);
try {
client.Send(msg);
return true;
}
catch (Exception e) {
string emsg = e.Source + "\n" + e.Message;
return false;
}
}
}
}
and here is the exception data
Message "The remote certificate is invalid according to the validation procedure." string
StackTrace " at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception)\r\n at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)\r\n at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)\r\n at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)\r\n at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)\r\n at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)\r\n at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)\r\n at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)\r\n at System.Net.Mail.SmtpConnection.Flush()\r\n at System.Net.Mail.ReadLinesCommand.Send(SmtpConnection conn)\r\n at System.Net.Mail.EHelloCommand.Send(SmtpConnection conn, String domain)\r\n at System.Net.Mail.SmtpConnection.GetConnection(ServicePoint servicePoint)\r\n at System.Net.Mail.SmtpClient.GetConnection()\r\n at System.Net.Mail.SmtpClient.Send(MailMessage message)\r\n at UserActor.UserActor.DeliverFeedbackMessage(String cur_msg, String remote_ip, String usr_agent) in C:\\testsrc\\DigitalRadar\\UserActor\\UserActor.cs:line 621" string

Answer 1

You're using SSL to connect to the mail server (smtp.mydomain.com). Check if the certificate on the mail server has a valid (CA signed) certificate. Maybe it's self-signed, or expired, or has a weak cypher.

Answer 2

Allright, I found a good workaround (without compromising security) to avoid this problem, I am answering my own question to help anyone that might have the same problem and end up here.
I should mention my SF version is 5.0.217, actors ver is 2.0.217, maybe newer ver. might not have the problem since the SF team is continuosly improving the framework. When I have some time I will check new ver and update this thread in case.
Coming back to the problem it seems the default cert validation fails when SmtpClient.Send is called from within a SF actor method. The same call made from a C# console app works great. The reason is beyond my understanding, maybe some SF glitch, anyway .NET allows to write and register a custom validation procedure to replace the default one, using this approach I solved the problem, but it's important to not blindly say "valid" to any certificate as I have seen suggested in many upvoted posts here on S.O, I recommend to actually check the certificate to see if it's good, otherwise you screw the security, then there is no point to use SSL or certificate at all. Having said that here is my validation code (adapt it to your own situation)
private bool MyValidateSmtpServerCertificate(object sender, X509Certificate certificate,
X509Chain chain, SslPolicyErrors sslPolicyErrors) {
if (sslPolicyErrors != SslPolicyErrors.None)
return false;
string[] subj_params = certificate.Subject.Split(',');
string common_name = string.Empty;
foreach (string param in subj_params) {
string[] sub_params = param.Split('=');
if (sub_params[0].Trim() == "CN")
common_name = sub_params[1].Trim();
}
string[] valid_names = {
common_const.smtpServer,
"*." + common_const.smtpServer,
};
if (!valid_names.Contains(common_name))
return false;
return true;
}
Register this function before calling the SmtpClient.Send with the following line:
ServicePointManager.ServerCertificateValidationCallback = MyValidateSmtpServerCertificate;
That's all, now my code inside the actor method works flawlessly, the email is securely and reliably delivered.