C# OAuth Call to login.MicrosoftOnline.com Results in TLS/SSL Error Sporadically

Hi Siward,

Thanks for reaching out to Microsoft Q&A.

Looks like the application cannot establish a trust relationship with the SSL certificate, which is often due to the certificate validation procedure failing.

• Ensure that your application is using a modern TLS version. You can set the desired TLS protocol at the start of your application with the following code:

System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11; // or include Tls13 if supported

• If the SSL certificate presented by login.microsoftonline.com is self-signed or issued by a non-public CA, your application may not trust it. Make sure that the required root and intermediate certificates are part of the trusted store.
• Since this issue appears sporadically, it might be due to load balancing where different endpoints could be using different certificates. Confirm that all nodes in your load balancing pool are presenting valid certificates from a trusted CA. If your application uses an internal load balancer or a reverse proxy, ensure that it is configured correctly not to terminate SSL connections prematurely.
• Check if your firewall, proxy server, or a similar network element could be interfering with SSL traffic or changing certificates mid-connection.
• Use tools like curl or Postman to test direct connectivity to https://login.microsoftonline.com from the environment where your application is running. This might give you insights into the response and any certificate issues:

curl -v https://login.microsoftonline.com

login.microsoftonline.com is run by microsoft. I was hoping someone knowledgeable of login server tell me what certificates it has and what certification paths are necessary. I tried opening the page manually using a browser from where my app sits but it never throws any SSL error. POSTMAN is simliar to a browser call. I difference is that I can control the HTTP method.

Perhaps I can bypass the load balancing and go directly to the server with the certificate that works. Again, someone knowledgeable of the microsoft login server should know.

Hello Siward,

Thanks for the update! I’ve reached out to you via private message to help with a couple of environment-specific clarifications. Once we sort that out, I’ll share the findings back here for the benefit of others as well.

I honestly don't know here that private message would appear.

I see an email about a private message. I click on it login, but I don't see where the private messages are shown.

I hope you can give me your findings.

1. What certification paths does the load balanced login.microsoftonline.com require? There is obviously more than one SSL certificate as I am getting randomly load balanced.
2. Can I point to a specific login.microsoftonline.com server to skip the load balancing? I think I would put the IP address in my /etc/host/ file as the domain is coded in the SSL certificate.