.Net 9 Core > TPM Provider > tlsv1 alert decrypt error:../ssl/record/rec_layer_s3.c:1584:SSL alert number 51

[serkanturhanxl]

If I run the openssl server and client commands it communicates to each other.

openssl s_server -provider tpm2 -provider default -propquery '?provider=tpm2' -accept 4567 -key handle:0x81000006 -cert ssl_certificate.pem -cert_chain combinedchain.pem -cipher AES128-GCM-SHA256 -max_protocol TLSv1.2

openssl s_client -connect localhost:4567 -cipher AES128-GCM-SHA256 -debug -msg -min_protocol TLSv1.2 -max_protocol TLSv1.2

But If I implement the Server command into a console application and (client the same as console) It gives error:

Interop+Crypto+OpenSslCryptographicException: error:0A000093:SSL routines::decryption failed

Here is the client side error:

4067BCE3AC7F0000:error:0A00041B:SSL routines:ssl3_read_bytes:tlsv1 alert decrypt error:../ssl/record/rec_layer_s3.c:1584:SSL alert number 51

Here is the wiereshark screenshot.

This is the code I used to get key from TPM.

string handle = "handle:0x81000006";
SafeEvpPKeyHandle privateKey = SafeEvpPKeyHandle.OpenKeyFromProvider("tpm2", handle);
RSAOpenSsl rsa = new(privateKey);
X509Certificate2 tmpCert = new X509Certificate2("/etc/ssl/certs/ssl_certificate.pem");
X509Certificate2 certificate = tmpCert.CopyWithPrivateKey(rsa);

Here is the code to set sslOptions:

SslServerAuthenticationOptions sslOptions = new SslServerAuthenticationOptions
{
    EnabledSslProtocols = SslProtocols.Tls12, // Only use these protocols
    CipherSuitesPolicy = new CipherSuitesPolicy(new[]
    {
        TlsCipherSuite.TLS_RSA_WITH_AES_128_GCM_SHA256
    }),
    ServerCertificate = cert, //cert from 0x81000006 handle
    ClientCertificateRequired = true,
    EncryptionPolicy = EncryptionPolicy.RequireEncryption,
    
};
_stream.AuthenticateAsServer(sslOptions);

Here is the example application to reproduce the issue:
https://github.com/serkanturhanxl/TPMHandler

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[bartonjs]

@krwq Any immediate thoughts spring to mind?