Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

When setting the .ImageTag("vnext-EN20251212") for CosmosDb preview emulator, the health check and connection to the service fail with System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. exception.

The problem seems to be the logic behind checking if the cosmosDB is preview or latest in

Workaround
You can override the tag in OnBeforeResourceStarted() callback.

var cosmos = builder.AddAzureCosmosDB("cosmos-db")
    .RunAsPreviewEmulator(emulator =>
    {
        emulator.WithDataExplorer();
        emulator.WithGatewayPort(8081);
    }).OnBeforeResourceStarted((e, _, _) =>
    {
        if (e.Annotations.OfType<ContainerImageAnnotation>().LastOrDefault() is { } existingImageAnnotation)
        {
            existingImageAnnotation.Tag = "vnext-EN20251212";
        }

        return Task.CompletedTask;
    });

Expected Behavior

Setting the container tag version explicitly works normally.

Steps To Reproduce

1. Run Aspire app with the following cosmos registration

using Microsoft.Extensions.DependencyInjection;

var builder = DistributedApplication.CreateBuilder(args);

#pragma warning disable ASPIRECOSMOSDB001 // Preview emulator is experimental
var cosmos = builder.AddAzureCosmosDB("cosmos-db")
    .RunAsPreviewEmulator(emulator =>
    {
        emulator.WithDataExplorer();
        emulator.WithGatewayPort(8081);
        emulator.WithImageTag("vnext-EN20251212");
    });

#pragma warning restore ASPIRECOSMOSDB001
var database = cosmos.AddCosmosDatabase("Database1");
var container = database.AddContainer("Container1", partitionKeyPaths: ["/id"]);

builder.Build().Run();

2. Observe the exception from trying to connect to database or health-check

Exceptions (if any)

System.Net.Http.HttpRequestException
HResult=0x80131501
Message=The SSL connection could not be established, see inner exception.
StackTrace:

This exception was originally thrown at this call stack:
System.Net.Security.SslStream.GetFrameSize(System.ReadOnlySpan) in SslStream.IO.cs
System.Net.Security.SslStream.EnsureFullTlsFrameAsync(System.Threading.CancellationToken, int) in SslStream.IO.cs
System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder.StateMachineBox.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(short) in PoolingAsyncValueTaskMethodBuilderT.cs
System.Net.Security.SslStream.ReceiveHandshakeFrameAsync(System.Threading.CancellationToken) in SslStream.IO.cs
System.Runtime.CompilerServices.ConfiguredValueTaskAwaitable.ConfiguredValueTaskAwaiter.GetResult() in ConfiguredValueTaskAwaitable.cs
System.Net.Security.SslStream.ForceAuthenticationAsync(bool, byte[], System.Threading.CancellationToken) in SslStream.IO.cs
System.Net.Http.ConnectHelper.EstablishSslConnectionAsync(System.Net.Security.SslClientAuthenticationOptions, System.Net.Http.HttpRequestMessage, bool, System.IO.Stream, System.Threading.CancellationToken) in ConnectHelper.cs

Inner Exception 1:
AuthenticationException: Cannot determine the frame size or a corrupted frame was received.

.NET Version info

.NET SDK:
Version: 10.0.101
Commit: fad253f51b
Workload version: 10.0.100-manifests.9f71effe
MSBuild version: 18.0.6+fad253f51

Runtime Environment:
OS Name: Windows
OS Version: 10.0.26100
OS Platform: Windows
RID: win-x64

Anything else?

• Aspire: 13.1