11

I am creating a web API in .NET Core. To debug it locally, I have created a console application that connects to my API. I am debugging in Linux.

When connecting to my local URL at https://localhost:5001/, my console application is throwing an AuthenticationException (The remote certificate is invalid according to the validation procedure).

I have tried to circumvent this in two ways:

  1. Have added ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true; but it has no effect.

  2. I have run dotnet dev-certs https --trust. Now my web browser doesn't complain anymore, which is nice, but my console application is still throwing the exception. Have tried rebooting.

How can I make .NET Core trust my localhost server? Or ignore the certificate validity?

4 Answers 4

18

Use the sample below from here

var httpClientHandler = new HttpClientHandler();
// Return `true` to allow certificates that are untrusted/invalid
httpClientHandler.ServerCertificateCustomValidationCallback = 
    HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;
var httpClient = new HttpClient(httpClientHandler);
2
  • 2
    Is there a way to do it globally? For cases where you’re not in control of the client’s behavior. I.e. An openidconnect backchannell call, that fires an https request where customization is not possible.
    – Luigi
    Dec 16, 2020 at 15:10
  • 1
    Update - looks like it was possible to customize after all: stackoverflow.com/a/63053190/1330361
    – Luigi
    Dec 16, 2020 at 15:27
2

I found the solution:

var httpClientHandler = new HttpClientHandler();

httpClientHandler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true; // DEBUGGING ONLY

var httpClient = new HttpClient(httpClientHandler);

Although it is still unclear to me why the certificate is not considered valid after running dotnet dev-certs https --trust.

-1

You should trust the certificate on your computer by importing it into the certificate store.

Disabling the validation is a bad idea, as you may forget to remove that code and then your finished product is insecure

4
  • I thought that was what dotnet dev-certs https --trust did?
    – HelloWorld
    Apr 15, 2019 at 9:54
  • Also, the console app is just for debugging, so it doesn't matter if I forget to remove it or not ;)
    – HelloWorld
    Apr 15, 2019 at 9:55
  • Maybe your certificate has the wrong subject name, how did you generate it?
    – Milney
    Apr 15, 2019 at 9:56
  • I didn't. Automatically generated by .NET Core when running the app.
    – HelloWorld
    Apr 15, 2019 at 9:59
-1

Define this functions:

public static void IgnoreBadCertificates()
{
    System.Net.ServicePointManager.ServerCertificateValidationCallback = new System.Net.Security.RemoteCertificateValidationCallback(AcceptAllCertifications);
}

private static bool AcceptAllCertifications(object sender, System.Security.Cryptography.X509Certificates.X509Certificate certification, System.Security.Cryptography.X509Certificates.X509Chain chain, System.Net.Security.SslPolicyErrors sslPolicyErrors)
{
    return true;
}

And use top of program like this:

IgnoreBadCertificates();
0

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.