Develop Reference

"Crypto settings changed" message shown when launching an Azure Cloud Service locally

I’m getting the following behavior when I try to launch an Azure Cloud Service locally
1) Popup that the debugging environment is getting ready is shown (step1.jpg)
2) Message “Your about to be signed out, crypto settings changed” is shown (step2.jpg)
3) Force restart of the notebook is performed (step3.jpg)
This is happening constantly in both debug and start without debugging options.
I tried changing the properties of the azure cloud service but it didn’t help. I also tried to use the internet what does this message mean and could not find any relevant data. appreciate ANY help. Thanks!

Check you ServiceDefinition.csdef for startup tasks. I think you maybe running the DisableSslv3.cmd script on your local machine causing it to force a restart. Just comment out the line while debugging locally.

In addition to the answer of #user2282308, I would say that in a more global approach, it worth to check the startup tasks in the serviceDefinition.csdef and verify that all tasks are executed as "expected".
#user22822308 spoke about DisableSslv3.cmd, but on my side, the issue was that the script runTLSsettings.cmd should be executed only when running on Azure service (this script ends with a reboot of the machine and the famous "crypto settings changed")
This is the serviceDefinition.csdef integration that is proposed by Microsoft for the runTLSSettings script:
<Startup>
<Task executionContext="elevated" taskType="simple" commandLine="RunTLSSettings.cmd">
</Task>
</Startup>
This is ok when debugging your cloud service in Visual Studio 2019, but as soon as you try to debug with Visual Studio 2022 you will receive the "Crypto settings changed".
My feeling is that the startup task is not done in VS 2019 meanwhile it is done in VS 2022.
Thus, what is missing is the definition of the environment variable that indicate to runTLSSettings script if we are running on emulator or not.
The environment variable definition is well explained in this other microsoft documentation:
https://learn.microsoft.com/en-us/azure/cloud-services/cloud-services-startup-tasks#environment-variables
At the end, this is the correct csdef:
<Startup>
<Task commandLine="runTLSSettings.cmd" executionContext="limited" taskType="simple">
<Environment>
<Variable name="ComputeEmulatorRunning">
<RoleInstanceValue xpath="/RoleEnvironment/Deployment/#emulated" />
</Variable>
</Environment>
</Task>

This happens every single time I run Visual Studio without elevated privilege's. When I start debugging the cloud service and the azure emulator starts, I get this message and the computer reboots.

Azure: getting service certificate without defining an additional configuration

My cloud service has the following config:
<?xml version="1.0" encoding="utf-8"?>
<ServiceConfiguration ...>
<Role name="...">
<ConfigurationSettings>
<Setting name="MyCertThumbprint" value="AB687DC9F63D51AE6E9522B86B97EFD15F55EA42" />
</ConfigurationSettings>
<Certificates>
<Certificate name="MyCert" thumbprint="AB687DC9F63D51AE6E9522B86B97EFD15F55EA42" thumbprintAlgorithm="sha1" />
</Certificates>
</Role>
</ServiceConfiguration>
See the redundance?
I want to get rid of MyCertThumbprint config. Is there an Azure API that gives me access to the thumbprint of MyCert? Or maybe the X509Certificate2 instance itself (i.e. without having to search for it using X509Store) ?

Sure - if you know other information about the certificate, you can use any of the X509FindType Enumerations with X509Certificate2Collection.Find Method. Unfortunately, the Certificates section of the ServiceConfiguration is for locating the certificate in the Cloud Service certificate store and installing that certificate on the VMs associated with the Role you are deploying. There is no API to access the section directly. So your choice is to hard code something like the certificate subject name or the thumbprint and hope it doesn't change, or add a setting like you've demonstrated in your code sample that is configurable with each deployment.
The ConfigurationSettings section mirrors the appSettings section in the web.config file and when used in conjunction with CloudConfigurationManager.GetSetting("settingsKey") with look first in the ServiceConnfiguration then in the web.config for application settings, allowing you to un local in an emulator or just IIS express and achieve the same functionality. So we duplicate the settings in both ServiceConfiguration and web.config.

Web application cannot talk to web service when run on IIS

I am calling a web service (for sms sending) in my asp.net web application. When my web application is on Developer Server, the web service is called and everything is fine, the expected results are returned. However, when the application is run on IIS, I cannot call the web service and I get this WebException:
"Unable to connect to the remote server"
And in details, InnerException, the message is "No connection could be made because the target machine actively refused it SomeIP:SomePort" where SomeIP is the web service IP address and SomePort is 80
(I was suspecting the problem is the port 80, since pinging SomeIP returns a response but Telnet on SomeIP SomePort fails. But I'm not sure if this is really the problem, I mean, how could the application set a different port when run on IIS!)
I really appreciate any help or ideas!

I had a similar issue wherein the unit test was successfully able to call the external web service, while the asp.net mvc application I was working on was unable to.
I had to a web.config entry to make it work. I am sharing the config entry, which I think, could help people with a similar issue. By the way, this section goes directly under the root element within web.config file. Replace proxy server name and port as applicable in your context.
<system.net>
<defaultProxy>
<proxy proxyaddress="http://<proxy server name>:<port>" />
</defaultProxy>
<!--<defaultProxy enabled="true" useDefaultCredentials="true">
<proxy usesystemdefault="True" bypassonlocal="True" />
</defaultProxy>-->
</system.net>

Problems posting via HTTPS from an IIS process (WCF & WF)

I have some code that wraps the PayflowPro .NET API. It essentially posts to a HTTPS address (a payment gateway) from C#. I can run this code locally and it works nicely. I can run it in my MSUnit tests and it works, and I can run it from a console application on my test environment and it also works.
I have a workflow hosted in IIS 6.1, which instantiates a class which in turn calls this code. When this workflow is started the code fails everytime; I get an error like System.Exception: Failed to connect to host Input Server Uri = https://pilot-payflowpro.paypal.com/ from the API object.
This exception is coming from the API, but I am completely lost as to how I can succesfully post from a console application but not from an IIS process.
The class is exactly the same, word for word.
I log in as administrator, so the console app is running as administrator. Therefore I have tried using the administrator account for the application pool for the website (for this testing only, obviously)
The console app can post so therefore the firewall / proxy aren't interfering... right?
Is there anything I need to adjust in IIS to allow an application to communicate outside? Are there any obvious security settings that I'm overlooking? Any suggestions for test cases to run to find out what might be going on?
edit: Turns out that this problem is somehow related to the VM environment in which the server is running. This problem doesn't occur on my development box, the test server or the production server - it's only occurring on the integration server. The cause is still unknown but I am no longer working on it.

This might be caused by an ASP.NET trust configuration issue. To check the trust level open the following file in an editor:
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config (if ASP.NET 2.0)
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\CONFIG\web.config (if ASP.NET 4.0)
You may also need to edit the C:\WINDOWS\Microsoft.NET\Framework64 versions of these if you're running on 64 bit Windows.
Scroll down to the <securityPolicy> configuration section which looks like:
<location allowOverride="false">
<system.web>
<securityPolicy>
<trustLevel name="Full" policyFile="internal"/>
<trustLevel name="High" policyFile="web_hightrust.config"/>
<trustLevel name="Medium" policyFile="web_mediumtrust.config"/>
<trustLevel name="Low" policyFile="web_lowtrust.config"/>
<trustLevel name="Minimal" policyFile="web_minimaltrust.config"/>
</securityPolicy>
<trust level="Medium" originUrl=""/>
</system.web>
</location>
If you see anything other than <trust level="Full" originUrl=""/> it means the server is running under Partial Trust.
Open the .config file specified by the relevant policyFile attribute, for example web_mediumtrust.config if level="Medium".
It's highly unlikely that the server will be running under anything less than Low Trust.
Locate the <NamedPermissionSets> section, under this there is a <PermissionSet> that looks like:
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="ASP.Net">
This contains a number of <IPermission> nodes. Look for one that called WebPermission, it looks like this:
<IPermission
class="WebPermission"
version="1">
If it's missing or looks like:
<IPermission
class="WebPermission"
version="1">
<ConnectAccess>
<URI uri="$OriginHost$"/>
</ConnectAccess>
</IPermission>
You need to add or modify so it looks like:
<IPermission
class="WebPermission"
version="1"
Unrestricted="true"/>
This setting controls outbound and inbound access from your application to or from a URI.
It may also be necessary to ensure that the SocketPermission configuration is similarly configured:
<IPermission
class="SocketPermission"
version="1"
Unrestricted="true"/>

Turns out that this problem is somehow related to the VM environment in which the server is running. This problem doesn't occur on my development box, the test server or the production server - it's only occurring on the integration server. The cause is still unknown but I am no longer working on it.

What is a good proxy for me to install and test my Windows Service?

The deployment requirements for my app (a windows service written in C#) state the presence of a Proxy server.
From my interaction with the person who will install my app:
1. His company blocks access to internet via the proxy
2. He needs to provide the path to the proxy script in his IE Config.
3. He also needs to input a user-name/password.
My application needs to access a publicly hosted WebService. In preparation, I sent him a test Winform app. In the app.config file I used the setting mentioned in this post .NET client app: how to reach Web Services in case of proxy?
However, it did not work. I customized the proxy setting in App.config as per his IE settings, yet nothing seemed to work.
I don't want to hard-code the proxy settings in my app using the System.Net classes. There is no doubt in my mind that I want to use the config file.
So, I want to install a proxy on a VPC image and try and get my application to run.
My question:
1. What is a good proxy that I can install on my VM (windows only - no linux/squid pls.) that will replicate the behaviour that I mentioned in 2 & 3 above.
2. In case it is of interest, the proxy settings I used was:
<system.net>
<defaultProxy >
<proxy usesystemdefault= “False“ proxyaddress=“http://10.1.10.10:8080“ bypassonlocal=“True“ />
</defaultProxy>
</system.net>
Assuming that the system will read the settings from IE, I also tried
<proxy autoDetect="true" />
It did not work.
Pls. let me know if my requirements are unclear.

The open source squid proxy has Windows binaries.
If you have a Windows Server OS in you VPC, you could try out Microsoft's very own ISA Server. There's a 180-day trial version here.