ubuntu-latest resulting in cryptography errors when making http requests

[prathikr]

Description

We are running the same test suite on windows/macos/ubuntu-latest and only the ubuntu-latest image is causing cryptography errors likely related to incompatible openssl versions in the ubuntu-latest vm.

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 22.04
• Ubuntu 24.04
• Ubuntu Slim
• macOS 14
• macOS 14 Arm64
• macOS 15
• macOS 15 Arm64
• macOS 26
• macOS 26 Arm64
• Windows Server 2022
• Windows Server 2025
• Windows Server 2025 with Visual Studio 2026

Image version and build link

Version: 20260201.15.1
Link to public failed build: https://github.com/microsoft/Foundry-Local/actions/runs/21614658336/job/62811326814?pr=409

Is it regression?

no, it has never worked

Expected behavior

We expect httpclient calls to succeed like they do for windows/macos-latest images

Actual behavior

Error: System.Net.Http.HttpRequestException: An error occurred while sending the request.
 ---> System.IO.IOException: The decryption operation failed, see inner exception.
 ---> Interop+OpenSsl+SslException: Decrypt failed with OpenSSL error - SSL_ERROR_SSL.
 ---> System.Security.Cryptography.CryptographicException: Error occurred during a cryptographic operation.
   --- End of inner exception stack trace ---
   at Interop.OpenSsl.Decrypt(SafeSslHandle, Span`1, Interop.Ssl.SslErrorCode&) + 0x118
   at System.Net.Security.SslStreamPal.DecryptMessage(SafeDeleteSslContext, Span`1, Int32&, Int32&) + 0x49
   --- End of inner exception stack trace ---
   at System.Net.Security.SslStream.<ReadAsyncInternal>d__170`1.MoveNext() + 0x753
--- End of stack trace from previous location ---
   at System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder`1.StateMachineBox`1.System.Threading.Tasks.Sources.IValueTaskSource<TResult>.GetResult(Int16) + 0x29
   at System.Net.Http.HttpConnection.<InitialFillAsync>d__81.MoveNext() + 0x1eb
--- End of stack trace from previous location ---
   at System.Net.Http.HttpConnection.<SendAsync>d__56.MoveNext() + 0x654
   --- End of inner exception stack trace ---
   at System.Net.Http.HttpConnection.<SendAsync>d__56.MoveNext() + 0x19de
--- End of stack trace from previous location ---
   at System.Net.Http.HttpConnectionPool.<SendWithVersionDetectionAndRetryAsync>d__50.MoveNext() + 0xa6b
--- End of stack trace from previous location ---
   at System.Net.Http.RedirectHandler.<SendAsync>d__4.MoveNext() + 0x1c8
--- End of stack trace from previous location ---
   at System.Net.Http.HttpClient.<<SendAsync>g__Core|83_0>d.MoveNext() + 0x3b1
--- End of stack trace from previous location ---
   at Microsoft.Neutron.AzureFoundry.AzureFoundryApiService.<FetchModelPageFromApiAsync>d__9.MoveNext() + 0x13f
--- End of stack trace from previous location ---
   at Microsoft.Neutron.AzureFoundry.AzureFoundryApiService.<FetchModelsAsyncImpl>d__13.MoveNext() + 0xd6
--- End of stack trace from previous location ---
   at Microsoft.Neutron.AzureFoundry.AzureFoundryApiService.<FetchAllLocalModelsAsyncImpl>d__12.MoveNext() + 0x55
--- End of stack trace from previous location ---
   at Microsoft.Neutron.AzureFoundry.AzureFoundryApiService.<FetchAllLocalModelsAsync>d__10.MoveNext() + 0x55
--- End of stack trace from previous location ---
   at Microsoft.Neutron.AzureFoundry.AzureFoundryService.<ListCatalogModelsAsync>d__13.MoveNext() + 0xaf0
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.AzureModelCatalog.<GetLatestCatalogAndCachedModelInfo>d__27.MoveNext() + 0x19f
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.AzureModelCatalog.<FetchModelInfoAsync>d__23.MoveNext() + 0x5f
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.BaseModelCatalog`1.<GetCachedInfoAsync>d__20.MoveNext() + 0x1be
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.BaseModelCatalog`1.<GetModelsAsync>d__8.MoveNext() + 0x61
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.NativeInterop.<>c__DisplayClass10_1.<<ExecuteCommandManaged>b__0>d.MoveNext() + 0x70
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.NativeInterop.<ExecuteWithTracker>d__9.MoveNext() + 0xbe
      at CoreInterop.executeCommand (src/detail/coreInterop.ts:103:23)
      at Catalog.updateModels (src/catalog.ts:41:48)
      at Catalog.getCachedModels (src/catalog.ts:109:20)
      at Context.<anonymous> (test/openai/chatClient.test.ts:55:44)
      at process.processImmediate (node:internal/timers:483:21)

Repro steps

using System.Net.Http;

HttpClient httpClient = new HttpClient();
HttpContent content = new StringContent("{}", Encoding.UTF8, "application/json");
HttpResponseMessage response = await httpClient.PostAsync("https://www.google.com", content, null);
Console.WriteLine(`Ping success: ${response.IsSuccessStatusCode}`);

[erik-bershel]

Hey @prathikr!

It seems interesting. Lemme have a look.

[erik-bershel]

At first glance it doesn't seem as an OpenSSL in image related issue. Simple test shows that current config works fine:

- name: Diagnostics (TLS / env)
  shell: bash
  run: |
    openssl version -a
    env | sort | egrep 'SSL|OPENSSL|DOTNET|NODE|NPM|HTTP|HTTPS|PROXY|LD_LIBRARY_PATH' || true
    curl -Iv https://www.google.com || true

Are you sure your project doesn't use other dependencies that come with .NET or somewhere else?