Context: Revocation checks reported \u201crevocation server was offline,\u201d then the client proceeded; long idle\/keep-alive reuse likely contributed to the close.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n <\/p>\n
Connection reuse vs server keep-alive: Apache is advertising Keep-Alive: timeout=3. The .NET client is reusing long-idle TLS connections via the proxy; by the time it sends application data, the server\/proxy has already closed the session, leading to \u201cunderlying connection was closed\u201d errors.<\/p>\n
Revocation checks through the proxy: The .NET trace shows \u201crevocation server was offline\u201d before proceeding. That extra handshake work plus proxy blocking CRL\/OCSP can increase latency and contribute to idle reuse issues.<\/p>\n
.NET SChannel quirks: Older HttpWebRequest\/ServicePoint behaviors (Expect100-Continue, connection pooling) can interact poorly with short keep-alive servers\/proxies.<\/p>\n
Luckily, this is a .NET application, and you can create custom configuration files for .NET apps. In the file with the binary, look for a text file named BinaryName.exe.config<\/p>\n
If none exists, create one. The following disables the proxy:<\/p>\n
<?xml version=”1.0″ encoding=”utf-8″?>
\n<configuration>
\n<system.net>
\n<!– Turn off use of the system proxy for this app –>
\n<defaultProxy enabled=”true”>
\n<proxy usesystemdefault=”false” \/>
\n<\/defaultProxy>
\n<\/system.net>
\n<\/configuration><\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Certificate Issuance Fails After requesting a certificate, the request immediately fails with the error: Failed to post CSR with error: Unknown certificate profile type. I think it is just a coincidence, but wanted to document the scenario in case it comes up again. The application makes web calls to a vendor API to issue certs. …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[2170,2169],"class_list":["post-11988","post","type-post","status-publish","format-standard","hentry","category-system-administration","tag-net","tag-venefi"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/11988","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11988"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/11988\/revisions"}],"predecessor-version":[{"id":11989,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/11988\/revisions\/11989"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11988"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11988"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11988"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}