.NET Agent fails to connect to Contrast UI

Issue

You're experiencing one or more of the following symptoms:

• The ContrastAgent Explorer and/or .NET agent logs report errors when connecting to the Contrast UI:
  

  Exception communicating with Contrast. Error: Error communicating with Contrast for request URL:'/Contrast/api/ng/servers/'

• Data from a server with the installed agent doesn't appear in the Contrast interface.

Cause

There can be several causes for this error but the end result is that the agent is unable to successfully communicate with the Contrast UI and is therefore unable to continue. 

If the error states:

System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

or

System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: PartialChain

then there is some issue with the certificate that the agent is receiving from the Contrast UI.

If the error states one of the following:

System.Net.WebException: The remote name could not be resolved

Response Code: Unauthorized

Response Code: PreconditionFailed

then there is likely a credential error in the agent's configuration file.

An error such as the following would suggest a possible firewall or proxy issue, resulting in the agent being unable to reach the network:

System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it

The following error transitioning app domains may be experienced if your application targets a .NET Framework version prior to 4.7:

Exception communicating with Contrast. Error: Error communicating with Contrast for request URL:'/Contrast/api/ng/servers/'. Exception: System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Exception: HttpRequestException cannot transition between app domains. Exception data was truncated at the boundary.

In the .NET Agent Sensor logs, search for TargetFramework: to confirm the version of the .NET Framework being targeted.

Resolution

Certificate Issues

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$webRequest = [Net.WebRequest]::Create("https://app.contrastsecurity.com")
try { $webRequest.GetResponse() } catch {}
$cert = $webRequest.ServicePoint.Certificate
$bytes = $cert.Export([Security.Cryptography.X509Certificates.X509ContentType]::Cert)
set-content -value $bytes -encoding byte -path "$pwd\contrast.cer"

openssl s_client -showcerts -connect {Contrast UI hostname}:{port} </dev/null 2>/dev/null | openssl x509 -outform PEM > contrast.crt

cp contrast.crt /usr/local/share/ca-certificates/
update-ca-certificates

cp contrast.crt /usr/share/pki/ca-trust-source/anchors/
update-ca-trust

api:
  certificate:
    ignore_cert_errors: true

Configuration Issues

For other issues, open the .NET agent's configuration file, contrast_security.yaml, which is located in the agent's working directory (i.e., %ProgramData%\Contrast\dotnet\). Then:

• Verify that the url value is correct. It should look similar to the following, although will vary if you have an on-premise Contrast UI install:

  api:
    url: https://app.contrastsecurity.com/Contrast

  Check the URL can be reached from a normal web browser on the server. If it can't be reached, you should review the network path and related settings between the server and the Contrast application.
• Verify proxy settings. If a web browser can connect to Contrast but the agent can't, the agent might be missing the proxy settings required by your network environment. You can configure a proxy using the following settings:

  api:
    proxy:
      enable: true
      url: <proxy url with port and scheme>
      user: <proxy user if required>
      pass: <proxy password if required>
      auth_type: <proxy auth type if required>

• Verify that the values of service_key and api_key are correct. If the above settings are correct, the API key used by your organization might have changed. Follow these directions to view your current API Key.

Error Transitioning app domains

api:
  tls_versions: tls12
agent:
  dotnet:
    enable_http_client_app_domain_isolation: false

More detail on the .NET agent's configuration properties can be found here. All properties can also be set as environment variables - this is especially useful if it's not possible to store the proxy password in a configuration file.