Unable to get certificate CRL on Linux server, works fine on Windows/WSL

[st1pps]

Hi,

I'm using Mailkit in a small program on a vps that regularly sends myself an email (long story). It uses my own SMTP server, secured by a LetsEncrypt certificate. Sending the email form my local machine and even from WSL works without a problem. The server and WSL run Ubuntu 24.04 and the latest .NET 9 version.
As soon as I run it on the server, I get the following error:

The server's SSL certificate could not be validated for the following reasons:
• The server certificate has the following errors:
  • unable to get certificate CRL
  • unable to get certificate CRL

 ---> System.Security.Authentication.AuthenticationException: The remote certificate was rejected by the provided RemoteCertificateValidationCallback.
   at System.Net.Security.SslStream.SendAuthResetSignal(ReadOnlySpan`1 alert, ExceptionDispatchInfo exception)
   at System.Net.Security.SslStream.CompleteHandshake(SslAuthenticationOptions sslAuthenticationOptions)
   at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](Boolean receiveFirst, Byte[] reAuthenticationData, CancellationToken cancellationToken)
   at MailKit.Net.Smtp.SmtpClient.SslHandshakeAsync(SslStream ssl, String host, CancellationToken cancellationToken)
   at MailKit.Net.Smtp.SmtpClient.ConnectAsync(String host, Int32 port, SecureSocketOptions options, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at MailKit.Net.Smtp.SmtpClient.ConnectAsync(String host, Int32 port, SecureSocketOptions options, CancellationToken cancellationToken)

It works if I set smtpClient.CheckCertificateRevocation = false;.
I looked up the CRL URL from the certificate, and can confirm what it can be opened from the server.

Does anyone have an idea what might be going wrong here?

[jstedfast]

The CRL lookups are happening in runtime class library code, so my guess is they'll be the only ones that can help you on this particular issue.

Wish I could help.