title: Intermittent SSL/TLS error on file upload
body: <p>I have some difficulties resolving an SSL/TLS error while consuming a REST web service.</p>
  
  <p>The REST web service is developed with the Spring Framework, using Spring Boot.</p>
  
  <p>The client is a .NET application, using RestSharp for the REST web service consumption.</p>
  
  <p>Everything worked fine until one client had an error during a file upload.</p>
  
  <pre class="lang-none prettyprint-override"><code>System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
  </code></pre>
  
  <p>I was still using the embedded Tomcat v8.5.5 at this time. On my Spring Boot application I had the following errors:</p>
  
  <pre><code>java.lang.NullPointerException: null
      at org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.getSslSupport(NioEndpoint.java:1329) ~[tomcat-embed-core-8.5.5.jar!/:8.5.5]
      // Etc.
  </code></pre>
  
  
  
  <pre><code>java.lang.NullPointerException: null
      at org.apache.tomcat.util.net.SecureNioChannel.handshake(SecureNioChannel.java:182) ~[tomcat-embed-core-8.5.5.jar!/:8.5.5]
      // Etc.
  </code></pre>
  
  <p>After some researches, I found <a href="http://tomcat.10.x6.nabble.com/NPE-in-SecureNioChannel-TC-8-5-5-td5055259.html" rel="nofollow noreferrer">this topic</a> about similar errors related to the embedded Tomcat v8.5.5. Following their advices, I upgraded the embedded Tomcat to v8.5.13.</p>
  
  <p>Nice, no more NPE from apache Tomcat. So, my .NET application should work... or not.</p>
  
  <pre class="lang-none prettyprint-override"><code>System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
  </code></pre>
  
  <p>Still the same error. Since I had no Tomcat error anymore, I changed the logging level of <code>org.apache</code> to DEBUG. And I found some new errors at the DEBUG level:</p>
  
  <pre><code>2017-05-10 14:58:05.889 DEBUG 928 --- [-nio-443-exec-4] o.a.tomcat.util.net.SocketWrapperBase    : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@3678fe26:org.apache.tomcat.util.net.SecureNioChannel@63c88911:java.nio.channels.SocketChannel[connected local=/... remote=/...]], Read from buffer: [0]
  2017-05-10 14:58:05.889 DEBUG 928 --- [-nio-443-exec-4] o.apache.coyote.http11.Http11Processor   : Error parsing HTTP request header
  
  java.io.EOFException: null
      at org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper.fillReadBuffer(NioEndpoint.java:1242) ~[tomcat-embed-core-8.5.13.jar!/:8.5.13]
      // Etc.
  
  2017-05-10 14:58:05.889 DEBUG 928 --- [-nio-443-exec-4] o.apache.coyote.http11.Http11Processor   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@3678fe26:org.apache.tomcat.util.net.SecureNioChannel@63c88911:java.nio.channels.SocketChannel[connected local=/... remote=/...]], Status in: [OPEN_READ], State out: [CLOSED]
  2017-05-10 14:58:05.889 DEBUG 928 --- [-nio-443-exec-4] org.apache.tomcat.util.net.NioEndpoint   : Failed to close socket
  
  java.nio.channels.ClosedChannelException: null
      at sun.nio.ch.SocketChannelImpl.ensureWriteOpen(Unknown Source) ~[na:1.8.0_91]
      // Etc.
  
  2017-05-10 14:58:05.889 DEBUG 928 --- [-nio-443-exec-4] o.apache.tomcat.util.threads.LimitLatch  : Counting down[https-jsse-nio-443-exec-4] latch=1
  </code></pre>
  
  
  
  <pre><code>2017-05-10 15:00:34.593 DEBUG 928 --- [-nio-443-exec-9] o.a.tomcat.util.net.SocketWrapperBase    : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@58361212:org.apache.tomcat.util.net.SecureNioChannel@63c88911:java.nio.channels.SocketChannel[connected local=/... remote=/...]], Read from buffer: [0]
  2017-05-10 15:00:34.593 DEBUG 928 --- [-nio-443-exec-9] o.apache.coyote.http11.Http11Processor   : Error parsing HTTP request header
  
  java.io.IOException: Unable to unwrap data, invalid status [CLOSED]
      at org.apache.tomcat.util.net.SecureNioChannel.read(SecureNioChannel.java:604) ~[tomcat-embed-core-8.5.13.jar!/:8.5.13]
      // Etc.
  
  2017-05-10 15:00:34.593 DEBUG 928 --- [-nio-443-exec-9] o.apache.coyote.http11.Http11Processor   : Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@58361212:org.apache.tomcat.util.net.SecureNioChannel@63c88911:java.nio.channels.SocketChannel[connected local=/... remote=/...]], Status in: [OPEN_READ], State out: [CLOSED]
  2017-05-10 15:00:34.593 DEBUG 928 --- [-nio-443-exec-9] org.apache.tomcat.util.net.NioEndpoint   : Failed to close socket
  
  java.nio.channels.ClosedChannelException: null
      at sun.nio.ch.SocketChannelImpl.ensureWriteOpen(Unknown Source) ~[na:1.8.0_91]
      // Etc.
  
  2017-05-10 15:00:34.593 DEBUG 928 --- [-nio-443-exec-9] o.apache.tomcat.util.threads.LimitLatch  : Counting down[https-jsse-nio-443-exec-9] latch=1
  </code></pre>
  
  <p>For what I understand, the client seems to successfully connect to the server but proceed to interrupt the connection during file transfer because of an SSL/TLS error, resulting in those <code>ClosedChannelException</code> server-side.</p>
  
  <p>Am I using RestSharp wrongly?</p>
  
  <pre><code>RestRequest request = new RestRequest("path/to/uri", Method.PUT);
  
  request.AddQueryParameter("myParam", myParam.ToString());
  request.AddFile("myFile", "path/to/file", "multipart");
  
  IRestResponse&lt;MyResponse&gt; response = myRestClient.Execute&lt;MyResponse&gt;(request);
  </code></pre>
  
  <p>Spring Boot code for this request:</p>
  
  <pre><code>@RequestMapping(method = RequestMethod.PUT, consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
  public MyResponse replace(@RequestParam Integer myParam, @RequestParam MultipartFile myFile) {
      // Etc.
  </code></pre>
  
  <p>The <code>PUT</code> method for <code>multipart</code> is not supported by default in Spring but I created my own <code>MultipartResolver</code> to handle it so the problem is not here.</p>
  
  <p>It looks like the problem only happens in one place, and only during file transfer. All other places work fine, but there are still the <code>EOFException</code> and <code>ClosedChannelException</code> server-side, even when it works client-side.</p>
  
  <p>Another obscure thing... it only happens sometimes. Sometimes the upload works, sometimes not.</p>
  
  <p>I am not an SSL expert so I wonder what could do that.</p>
  
  <ul>
  <li>Something not synchronized between the client and the server?</li>
  <li>An interruption between the client and the server, resulting the <code>ClosedChannelException</code>?</li>
  </ul>
  
  <p>I am open to all suggestions and will continue to investigate, and hopefully find something...</p>
  
  <hr>
  
  <p><strong>EDIT 2017-05-11</strong></p>
  
  <p>Precision from comments:</p>
  
  <ul>
  <li>The .NET application is built with the Microsoft Windows .NET Framework (not Mono).</li>
  <li>The SSL certificate (server-side) is a complete chain in a PKCS#12 file.</li>
  </ul>
  
  <p>Information retrieved since I posted the question:</p>
  
  <ul>
  <li>The bug only happens if the .NET application is open for a certain amount of time; it will not occur if opened and closed in less than a minute.</li>
  <li>Host OS: Windows 10 Pro x64... but <code>System.Environment.OSVersion.VersionString</code> gives Windows NT 6.2.9200.0. According to <a href="https://en.wikipedia.org/wiki/Windows_NT#Releases" rel="nofollow noreferrer">Wikipedia</a> this kernel version correspond to Windows 8 or Server 2012, not 10. <strong>EDIT</strong> Ok, this is a known behavior. See <a href="https://stackoverflow.com/questions/33328739/c-sharp-system-environment-osversion-returns-wrong-version">here</a> and <a href="https://stackoverflow.com/questions/31520192/windows-10-rtm-osversion-not-returning-what-i-expect">here</a>. So this has nothing to do with the error.</li>
  <li>Trying to reproduce the bug without success on my side. I suspect more and more a bad configuration on the host machine or network.</li>
  <li>As seen on the code above, the <code>RestClient</code> object is instantiated only once and used everywhere in the application. Could it be an issue?</li>
  </ul>
  
  <p>Investigation continues.</p>