title: SSL Issue - Unable to connect to multiple containers using docker-compose
body: <p>I am starting on Docker-Compose using .Net core and have hit an issue with SSL handshake while communicating between the containers.</p>
  
  <p><strong>Stack</strong> 
  .Net Core 2.2, 
  Docker CE for Windows (Linux Containers) 2.0.0.3, 
  Docker Compose 3.4, 
  VS2019 Update 2,
  Windows 10,
  Chrome Version 74.0.3729.131 (Official Build) (64-bit)</p>
  
  <p>I have an API being called by another api using HttpClient. I have added them in one docker-compose project and they are referenced using the service names:</p>
  
  <pre><code>version: '3.4'
  
  services:
    caller.api:
      environment:
        - ASPNETCORE_ENVIRONMENT=Development
        - ASPNETCORE_URLS=https://+:80
        - ASPNETCORE_HTTPS_PORT=44391
        - FirstServiceUrl=https://callee.api
      depends_on:
        - callee.api
      ports:
        - "44391:80"
      volumes:
        - ${APPDATA}/ASP.NET/Https:/root/.aspnet/https:ro
        - ${APPDATA}/Microsoft/UserSecrets:/root/.microsoft/usersecrets:ro
  
    callee.api:
      environment:
        - ASPNETCORE_ENVIRONMENT=Development
        - ASPNETCORE_URLS=https://+:80
        - ASPNETCORE_HTTPS_PORT=44392
      ports:
        - "44392:80"
      volumes:
        - ${APPDATA}/ASP.NET/Https:/root/.aspnet/https:ro
        - ${APPDATA}/Microsoft/UserSecrets:/root/.microsoft/usersecrets:ro
  
  
  </code></pre>
  
  <p>However, these caller fails to call the callee and I get different kind of errors based on the below cases.</p>
  
  <p>I've tried a number of things : </p>
  
  <ol>
  <li><p><strong>dotnet dev-certs https</strong>
  This obviously allows the api's running outside docker-compose to run on SSL and dont have any issues in communication</p></li>
  <li><p><strong>Generate and Use self signed certs</strong>
  I used the information <a href="https://www.humankode.com/asp-net-core/develop-locally-with-https-self-signed-certificates-and-asp-net-core" rel="nofollow noreferrer">here</a> and created the certificates. </p></li>
  </ol>
  
  <p>They're added to the Trusted root. I can see them in Cert Manager.
  <br/>
  Added the following code in the API Main: </p>
  
  <pre class="lang-cs prettyprint-override"><code>var builder = WebHost.CreateDefaultBuilder(args);
  builder.ConfigureAppConfiguration((ctx, cfg) =&gt; cfg.AddEnvironmentVariables());
  
  builder.UseKestrel(options =&gt;
  {
       options.AddServerHeader = false;
       options.ListenAnyIP(80, o =&gt;
       {
            o.UseHttps( new X509Certificate2( "callee.api.pfx", "password"));
       });
  })
  .UseStartup&lt;Startup&gt;();
  </code></pre>
  
  <p>But when I launch Chrome(to test using swagger), the browser shows <a href="https://i.stack.imgur.com/23CyB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/23CyB.png" alt="Not Secure Error"></a></p>
  
  <p>I get this exception: </p>
  
  <pre class="lang-cs prettyprint-override"><code>      Failed to authenticate HTTPS connection.
  System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---&gt; Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL. ---&gt; Interop+Crypto+OpenSslCryptographicException: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown
     --- End of inner exception stack trace ---
     at Interop.OpenSsl.DoSslHandshake(SafeSslHandle context, Byte[] recvBuf, Int32 recvOffset, Int32 recvCount, Byte[]&amp; sendBuf, Int32&amp; sendCount)
     at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential, SafeDeleteContext&amp; context, SecurityBuffer inputBuffer, SecurityBuffer outputBuffer, SslAuthenticationOptions sslAuthenticationOptions)
     --- End of inner exception stack trace ---
  </code></pre>
  
  <p>I tried first with creating certificate as localhost.pfx which didnt work.
  I also tried with certificate callee.pfx but without any success.</p>
  
  <ol start="3">
  <li><strong>Several</strong> different approaches similar to (2) above but no joy.</li>
  </ol>
  
  <p>I am able to get to the individual API's in the browser and can manually run them fine.</p>
  
  <p>When I disable SSL, they are able to interact without any issues. </p>
  
  <p>I've spent couple of days trying to get this to work. Would really appreciate any help or pointers. </p>