Configure sending certificate chain as a client

[alexandr-osprey]

Hello, I am configuring YARP with TLS 1.2. to connect to nginx. nginx has my root certificate which it's supposed to use to validate my chain with. The problem is YARP is not sending a full chain, rather the final certificate. What am I doing wrong?

nginx has error
"client SSL certificate verify error: (21:unable to verify the first certificate) while reading client request headers"

I used wireshark to investigate, here I see that only final certificate is sent, despite 3 of them setup earlier

while nginx sends the whole chain

both client (yarp) and server (nginx) have the same chain

[karelz]

I believe that it is normal for HttpClient to send only final certificate and not the full chain. I also don't think there is way to configure it otherwise.
@wfurt can you please confirm or correct my claims here?

[wfurt]

HttPCLient/SslStream will send the intermediates if they are available. What platform are you running on @alexandr-osprey? On Windows, you have to put the intermediates into "CA" system store.

[alexandr-osprey]

Centos 7, net core 3.1
I've managed to get it working by using SSL_CERT_PATH SSL_CERT_FILE variable pointing to pem chain, as found out in dotnet/runtime#26323 (comment)

now final and intermediate certs (without root) are sent, which seem enough for my case

[wfurt]

one more note that the .NET should try to get the CAs if distribution points are in the certificates. That of course depends on network connectivity. (and SSL_CERT_PATH or adding it to Ca store does not)