ExAzureKeyVault.Client.connect() leads to TLS handshake error

[pekayde]

Hello,

i want to use the library for a project i am working on to read secret from the Azure Key Vault unfortunately, when try to connect from my local machine or from a docker container to Azure and the library is calling the auth_url. I receive a Handshake Failure.

Here is the error message:

2025-05-15 14:50:12 TLS client: In state certify at ssl_handshake.erl:2186 generated CLIENT ALERT: Fatal - Handshake Failure
2025-05-15 14:50:12  - {bad_cert,
2025-05-15 14:50:12        {hostname_check_failed,
2025-05-15 14:50:12            {requested,{20,190,160,5}},
2025-05-15 14:50:12            {received,
2025-05-15 14:50:12                [{dNSName,"graph.windows.net"},
2025-05-15 14:50:12                 {dNSName,"*.aadg.windows.net"},
2025-05-15 14:50:12                 {dNSName,"*.aadkds.ppe.reporting.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.aadkds.prd.reporting.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.accesscontrol.aadtst3.windows-int.net"},
2025-05-15 14:50:12                 {dNSName,"*.accesscontrol.windows-ppe.net"},
2025-05-15 14:50:12                 {dNSName,"*.accesscontrol.windows.net"},
2025-05-15 14:50:12                 {dNSName,"*.adls.aadkds.ppe.reporting.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.adls.aadkds.prd.reporting.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.adti.aadkds.ppe.reporting.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.adti.aadkds.prd.reporting.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.authapp.net"},
2025-05-15 14:50:12                 {dNSName,"*.b2clogin.com"},
2025-05-15 14:50:12                 {dNSName,"*.cpim.windows.net"},
2025-05-15 14:50:12                 {dNSName,"*.d2k.aadkds.ppe.reporting.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.d2k.aadkds.prd.reporting.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.gateway.windows.net"},
2025-05-15 14:50:12                 {dNSName,"*.login.live-int.com"},
2025-05-15 14:50:12                 {dNSName,"*.login.live.com"},
2025-05-15 14:50:12                 {dNSName,"*.login.microsoft.com"},
2025-05-15 14:50:12                 {dNSName,"*.login.microsoftonline.com"},
2025-05-15 14:50:12                 {dNSName,"*.login.windows-ppe.net"},
2025-05-15 14:50:12                 {dNSName,"*.logincert.microsoft.com"},
2025-05-15 14:50:12                 {dNSName,"*.logincert.windows-ppe.net"},
2025-05-15 14:50:12                 {dNSName,"*.microsoftaik-int.azure-int.net"},
2025-05-15 14:50:12                 {dNSName,"*.microsoftaik.azure.net"},
2025-05-15 14:50:12                 {dNSName,"*.pt.aadg.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.r.login.microsoft.com"},
2025-05-15 14:50:12                 {dNSName,"*.r.login.microsoftonline.com"},
2025-05-15 14:50:12                 {dNSName,"*.r.prd.aadg.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"*.windows-ppe.net"},
2025-05-15 14:50:12                 {dNSName,"aadcdn.privatelink.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"aadcdnimages.privatelink.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"aadg.windows.net"},
2025-05-15 14:50:12                 {dNSName,"aadgv6.ppe.windows.net"},
2025-05-15 14:50:12                 {dNSName,"aadgv6.windows.net"},
2025-05-15 14:50:12                 {dNSName,"accesscontrol.aadtst3.windows-int.net"},
2025-05-15 14:50:12                 {dNSName,"api.password.ccsctp.com"},
2025-05-15 14:50:12                 {dNSName,"api.passwordreset.microsoftonline.com"},
2025-05-15 14:50:12                 {dNSName,"autologon.microsoftazuread-sso.com"},
2025-05-15 14:50:12                 {dNSName,"clientconfig.microsoftonline-p-int.net"},
2025-05-15 14:50:12                 {dNSName,"clientconfig.microsoftonline-p.net"},
2025-05-15 14:50:12                 {dNSName,"directoryproxy.ppe.windows.net"},
2025-05-15 14:50:12                 {dNSName,"directoryproxy.windows.net"},
2025-05-15 14:50:12                 {dNSName,"gatewayforking.windows.net"},
2025-05-15 14:50:12                 {dNSName,"graph.ppe.windows.net"},
2025-05-15 14:50:12                 {dNSName,"login.live-int.com"},
2025-05-15 14:50:12                 {dNSName,"login.live.com"},
2025-05-15 14:50:12                 {dNSName,"login.microsoft-ppe.com"},
2025-05-15 14:50:12                 {dNSName,"login.microsoft.com"},
2025-05-15 14:50:12                 {dNSName,"login.microsoftonline-p.com"},
2025-05-15 14:50:12                 {dNSName,"login.microsoftonline.com"},
2025-05-15 14:50:12                 {dNSName,"login.windows.net"},
2025-05-15 14:50:12                 {dNSName,"logincert.microsoftonline.com"},
2025-05-15 14:50:12                 {dNSName,"microsoftaik-int.azure-int.net"},
2025-05-15 14:50:12                 {dNSName,"microsoftaik.azure.net"},
2025-05-15 14:50:12                 {dNSName,"nexus.microsoftonline-p-int.com"},
2025-05-15 14:50:12                 {dNSName,"nexus.microsoftonline-p.com"},
2025-05-15 14:50:12                 {dNSName,"nexus.passport-int.com"},
2025-05-15 14:50:12                 {dNSName,"password.ccsctp.com"},
2025-05-15 14:50:12                 {dNSName,"passwordreset.microsoftonline.com"},
2025-05-15 14:50:12                 {dNSName,"ppe.aadcdn.privatelink.msidentity.com"},
2025-05-15 14:50:12                 {dNSName,"sts.windows.net"}]}}}

All ideas i have is that probably something is wrong with the hard coded auth_url to login.windows.net. Would be great if some could a look and probably assist me on how to solve it.

I happily provide any additional information you may need.

[pekayde]

I found out that the ssl_options that are set in auth.ex line 56 the ssl_options of HTTPoison are overriden by the HTTPUtils.options_ssl(). The default ssl_options HTTPoison uses are

{:versions, [:"tlsv1.2", :"tlsv1.3"]},
      {:verify, :verify_peer},
      {:cacertfile, :certifi.cacertfile()},
      {:depth, 10},
      {:customize_hostname_check,
       [
         match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
       ]}

which seem to work fine. Therefore it would be good either the default ssl_options and HTTPUtils.options_ssl() are removed or the use of the default ssl options are configurable through env variables.

[pekayde]

Same is true for fetching the secrets. Same problem with the ssl_options and no problem when removing the HTTPUtils.options_ssl() and calling HTTPoison.get without.