EncryptionPolicy Enum

Namespace: System.Net.Security

Defines the policy that dictates whether the client or server application trusts the Certificate Authority (CA) that issued the server's X.509 certificate.

Members

Remarks

The EncryptionPolicy enumeration is used to specify the level of trust your application has in the certificates presented by the server when establishing a secure SSL/TLS connection. The client application uses this policy to determine whether to accept or reject the server's certificate.

When using SslStream, you can configure the certificate validation behavior by passing an EncryptionPolicy value to the SslStream constructor or by setting the EncryptionPolicy property on an existing SslStream instance.

ChainTrust

This is the most common and generally recommended policy. It indicates that the client trusts the server's certificate if it is issued by a Certificate Authority (CA) that is trusted by the client's operating system (i.e., present in the client's trusted root certificate store).

UnknownCa

This policy is typically used for development or testing environments where you might be using self-signed certificates or certificates issued by an internal CA that is not recognized by public trusted CAs. Using this policy in production is generally discouraged as it weakens the security of your application by trusting potentially untrusted authorities.

InvalidCertificate

This policy signifies that the certificate is considered invalid by the client. This could be due to various reasons, such as expiration, a hostname mismatch, or a revoked certificate. The client application should generally not proceed with the connection if it receives an InvalidCertificate status.

Requirements

Namespace: System.Net.Security

Assembly: System.dll (in System.dll)

Example

The following C# code snippet demonstrates how to use EncryptionPolicy with SslStream to establish a secure connection.

using System;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using System.Threading.Tasks;

public class SslClient
{
    public async Task ConnectAsync(string host, int port)
    {
        TcpClient client = new TcpClient();
        await client.ConnectAsync(host, port);

        SslStream sslStream = new SslStream(
            client.GetStream(),
            false,
            new RemoteCertificateValidationCallback(ValidateServerCertificate),
            null
        );

        // Use ChainTrust for typical production environments
        // For testing with self-signed certs, you might use a custom validation that accepts them
        // sslStream.EncryptionPolicy = EncryptionPolicy.ChainTrust; // Default behavior is often ChainTrust

        try
        {
            await sslStream.AuthenticateAsClientAsync(host);
            Console.WriteLine("SSL connection established.");
            // ... perform encrypted communication ...
        }
        catch (Exception ex)
        {
            Console.WriteLine($"Authentication failed: {ex.Message}");
        }
        finally
        {
            sslStream.Close();
            client.Close();
        }
    }

    public bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
    {
        // For production, rigorously validate the certificate.
        // Check for errors like sslPolicyErrors != SslPolicyErrors.None
        // and ensure the certificate is from a trusted issuer and matches the hostname.

        if (sslPolicyErrors == SslPolicyErrors.None)
        {
            return true; // Certificate is valid and trusted
        }

        // Example: For development, you might ignore certain errors like UnknownCA
        // This is NOT recommended for production environments.
        // Console.WriteLine($"Certificate error: {sslPolicyErrors}");
        // return sslPolicyErrors == SslPolicyErrors.None || sslPolicyErrors == SslPolicyErrors.RemoteCertificateChainErrors;

        Console.WriteLine($"Certificate validation failed. Errors: {sslPolicyErrors}");
        return false; // Reject the certificate
    }
}