"ERR_QUIC_PROTOCOL_ERROR" With "appSettings.json" SNI, But Succeeds Without SNI

[vindicatorr]

I don't want to submit this as a bug if it isn't, but will pose this as a question whether or not appSettings.json is being set incorrectly...

HTTP/3 SNI - Fail

appSettings.json SNI - Fail:

{
    "Logging": {
        "LogLevel": {
            "Default": "Trace",
            "Microsoft.AspNetCore": "Trace"
        }
    },
    "AllowedHosts": "localhost",
    "Kestrel": {
        "Endpoints": {
            "localhostEndpoint3":{
                "Url": "https://*:5003",
                "Sni": {
                    "localhost":{
                        "Certificate": {
                            "Path": "/<pathToCertificate>"
                        },
                        "Protocols": "Http3",
                        "SslProtocols": [
                            "Tls13"
                        ]
                    }
                }
            }
        }
    }
}

Debug Log SNI - Fail:

dbug: Microsoft.Extensions.Hosting.Internal.Host[1]
      Hosting starting
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[1]
      Unable to locate an appropriate development https certificate.
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[4]
      Created directory watcher for '/<pathToDirContainingCertificate>'.
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[5]
      Created file watcher for '/<pathToCertificate>'.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[11]
      Added observer to file watcher for '/<pathToCertificate>'.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[13]
      File '/<pathToCertificate>' now has 1 observers.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[14]
      Directory '/<pathToDirContainingCertificate>' now has watchers on 1 files.
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: https://[::]:5003
dbug: Microsoft.AspNetCore.Hosting.Diagnostics[13]
      Loaded hosting startup assembly http3
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: /<pathToProject>
dbug: Microsoft.Extensions.Hosting.Internal.Host[2]
      Hosting started

Browser SNI - Fail:
https://localhost:5003/
ERR_QUIC_PROTOCOL_ERROR

HTTP/3 No SNI - Success

appSettings.json No SNI - Success:

{
    "Logging": {
        "LogLevel": {
            "Default": "Trace",
            "Microsoft.AspNetCore": "Trace"
        }
    },
    "AllowedHosts": "localhost",
    "Kestrel": {
        "Endpoints": {
            "Https": {
                "SslProtocols": [
                    "Tls13"
                ],
                "Url": "https://localhost:5003",
                "Protocols": "Http3",
                "Certificate": {
                    "Path": "/<pathToCertificate>"
                }
            }
        }
    }
}

Debug Log No SNI - Success:

dbug: Microsoft.Extensions.Hosting.Internal.Host[1]
      Hosting starting
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[4]
      Created directory watcher for '/<pathToDirContainingCertificate>'.
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[5]
      Created file watcher for '/<pathToCertificate>'.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[11]
      Added observer to file watcher for '/<pathToCertificate>'.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[13]
      File '/<pathToCertificate>' now has 1 observers.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[14]
      Directory '/<pathToDirContainingCertificate>' now has watchers on 1 files.
dbug: Microsoft.AspNetCore.Server.Kestrel.Transport.Quic[20]
      QUIC listener starting with configured endpoint 127.0.0.1:5003.
dbug: Microsoft.AspNetCore.Server.Kestrel.Transport.Quic[20]
      QUIC listener starting with configured endpoint [::1]:5003.
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: https://localhost:5003
dbug: Microsoft.AspNetCore.Hosting.Diagnostics[13]
      Loaded hosting startup assembly http3
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: /<pathToProject>
dbug: Microsoft.Extensions.Hosting.Internal.Host[2]
      Hosting started
dbug: Microsoft.AspNetCore.Server.Kestrel.Transport.Quic[1]
      Connection id "0HMV9HMLK7E9T" accepted.
<...>

Browser No SNI - Success:
https://localhost:5003/
Hello World

HTTP/2 SNI - Success

appSettings.json HTTP/2 SNI - Success:

{
    "Logging": {
        "LogLevel": {
            "Default": "Trace",
            "Microsoft.AspNetCore": "Trace"
        }
    },
    "AllowedHosts": "localhost",
    "Kestrel": {
        "Endpoints": {
            "localhostEndpoint2":{
                "Url": "https://*:5002",
                "Sni": {
                    "localhost":{
                        "Certificate": {
                            "Path": "/<pathToCertificate>"
                        },
                        "Protocols": "Http2",
                        "SslProtocols": [
                            "Tls13"
                        ]
                    }
                }
            }
        }
    }
}

Debug Log HTTP/2 SNI - Success:

dbug: Microsoft.Extensions.Hosting.Internal.Host[1]
      Hosting starting
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[1]
      Unable to locate an appropriate development https certificate.
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[4]
      Created directory watcher for '/<pathToDirContainingCertificate>'.
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[5]
      Created file watcher for '/<pathToCertificate>'.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[11]
      Added observer to file watcher for '/<pathToCertificate>'.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[13]
      File '/<pathToCertificate>' now has 1 observers.
trce: Microsoft.AspNetCore.Server.Kestrel.Core.Internal.CertificatePathWatcher[14]
      Directory '/<pathToDirContainingCertificate>' now has watchers on 1 files.
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: https://[::]:5002
dbug: Microsoft.AspNetCore.Hosting.Diagnostics[13]
      Loaded hosting startup assembly http3
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: /<pathToProject>
dbug: Microsoft.Extensions.Hosting.Internal.Host[2]
      Hosting started
dbug: Microsoft.AspNetCore.Server.Kestrel.Connections[39]
      Connection id "0HMV9HRH0QTKN" accepted.
<...>

Browser HTTP/2 SNI - Success:
https://localhost:5002/
Hello World

[ManickaP]

Is your cert by any chance self-signed?
Browsers do not allow QUIC connection with self-signed cert, see https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel/http3?view=aspnetcore-8.0#localhost-testing

You should be able to test with HttpClient and RemoteCertificateValidationCallback.

[vindicatorr]

It is self-signed and trusted in chrome with the enable-quic and origin-to-force-quic-on flags set.
Note my title even stated But Succeeds Without SNI.

[nibanks]

@vindicatorr did you ever find a solution here?

[vindicatorr]

Nope, but also been working on other stuff as the other "success"es have been good enough for me for now.