System.Net.Http.HttpRequestException SSL/TLS failure in CI
An HttpRequestException with an SSL message means an outbound HTTPS call failed during the TLS handshake or certificate validation. Some causes are deterministic (a missing CA cert, an untrusted self-signed endpoint) and some are transient (a momentary network or DNS blip from the runner).
What this error means
A test or build step throws System.Net.Http.HttpRequestException: The SSL connection could not be established, sometimes with an inner authentication or socket error. It may be deterministic or intermittent.
System.Net.Http.HttpRequestException: The SSL connection could not be established,
see inner exception.
---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid.Common causes
Untrusted or missing certificate
The runner lacks the CA certificate for the endpoint, or the endpoint presents a self-signed/expired certificate, so validation fails deterministically.
A transient network or DNS blip
A momentary connectivity or DNS resolution failure from the runner aborts the handshake on one attempt.
How to fix it
Fix trust, or retry transient failures
- For a real trust problem, install the required CA cert on the runner or fix the endpoint certificate (do not blanket-disable validation).
- For an intermittent handshake/DNS failure with no config change, re-run.
- Self-healing managed runners (Latchkey) auto-retry transient network/SSL failures so a one-off blip does not fail the pipeline.
How to prevent it
- Provision required CA certificates on runners; avoid disabling certificate validation.
- Add resilient HTTP retries for idempotent calls.
- Run CI on self-healing managed runners that auto-retry transient network failures.