Rare Failures Reaching Akamai CDN in .NET Install Script

[nagilson]

Based on our telemetry, there are a few endpoints that users hit at Akamai which did not resolve when downloading the .NET .zip or .tar.gz via the install script. The user had to have stable enough internet in these cases to download the install-script, yet couldn't get the archive.

I seem to see this around 2% of the time, but this also includes slow networks which time out, so 2% is an upper bound overestimate.
Whether this is something we can resolve is uncertain - some of the issues seem to stem from TLS 1.2 not being enabled, or access restrictions, but they are interesting nonetheless.

If you're interested in some specific IPs that failed from Akamai or Microsoft let me know. I was able to resolve them myself.

A socket operation was attempted to an unreachable network (AKAMAI IP :443)
 Downloading from "legacy" link has failed with error:
 Error: Unable to download https:/<REDACTED: user-file-path> Returned HTTP status code: 404 Downloading from "legacy" link has failed with error: 

This happened in the India, USA, Australia, Netherlands, Thailand and other countries, so it's not just isolated.

The install script fails with the following. Note that it's using a .NET http client to make requests. https://github.com/dotnet/install-scripts/blob/a9e14346b38222a66d2a1c43567111d38cd1f79f/src/dotnet-install.ps1#L373

EDACTED: user-file-path>:1318 char:5
+     throw "Could not find `"$assetName`" with version = $($DownloadLi ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (Could not find ...on .NET support:String) [], RuntimeException
    + FullyQualifiedErrorId : Could not find "ASP.NET Core Runtime" with version = 8.0.22
Refer to: https:/<REDACTED: user-file-path> for information on .NET support

This seems to manifest in a few ways:

Ensure TLS 1.2 is enabled

Error: An error occurred while sending the request.
The underlying connection was closed: Could not establish trust relationship for the [AKAMAI] secure channel.
The remote certificate is invalid according to the validation procedure.
Ensure that TLS 1.2 or higher is enabled to use this script.
 Downloading from "primary" link has failed with error:

Socket to Unreachable Network

.NET install timed out.
You should change the timeout if you have a slow connection. See: https:/<REDACTED: user-file-path>#install-script-timeouts.
Our CDN may be blocked in China or experience significant slowdown, in which case you should install .NET manually., MESSAGE: Command failed: powershell.exe -NoProfile -NonInteractive -NoLogo -ExecutionPolicy bypass -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; & '<REDACTED: user-file-path> <REDACTED: user-file-path>' -InstallDir '<REDACTED: user-file-path>~x64' -Version 7.0.20 -Verbose -Runtime dotnet -Architecture x64 }"
dotnet-install: Downloading from "primary" link has failed with error:
Uri: https:/<REDACTED: user-file-path>
StatusCode: 
Error: An error occurred while sending the request.
Unable to connect to the remote server
A socket operation was attempted to an unreachable network (AKAMAI IP)
 Downloading from "legacy" link has failed with error:
Uri: https:/<REDACTED: user-file-path>
StatusCode: 404
Error: Unable to download https:/<REDACTED: user-file-path> Returned HTTP status code: 404 Downloading from "legacy" link has failed with error

Socket Forbidden by Access Permissions

\nError: An error occurred while sending the request.\r\nUnable to connect to the remote server\r\nAn attempt was made to access a socket in a way forbidden by its access permissions (AKAMAI IP:443)\r\n Downloading from \"primary\" link has failed with error:\nUri: https:/<REDACTED: user-file-path>\nStatusCode: \nError: An error occurred while sending the request.\r\nUnable to connect to the remote server\r\nAn attempt was made to access a socket in a way forbidden by its access permissions \r\n\r\ndotnet-install: Downloading from \"primary\" link has failed with error:\nUri: https:/<REDACTED: user-file-path>\nStatusCode: \nError: An error occurred while sending the request.\r\nUnable to connect to the remote server\r\nAn attempt was made to access a socket in a way forbidden by its access permissions (MSFT AZURE IP:443)\r\n Downloading from \"primary\" link has failed with error:\nUri: https:/<REDACTED: user-file-path>\nStatusCode: \nError: An error occurred while sending the request.\r\nUnable to connect to the remote server\r\nAn attempt was made to access a socket in a way forbidden by its access permissions\r\n\r\nCould not find \"ASP.NET Core Runtime\" with version = 9.0.11\r\nRefer to: https:/<REDACTED: user-file-path> for information on .NET support\r\nAt <REDACTED: user-file-path> \r\n<REDACTED: user-file-path>:1319 char:5\r\n+     throw \"Could not find `\"$assetName`\" with version = $($DownloadLi ...\r\n+