Microsoft Learn

C# Example: Custom Certificate Validation

This example demonstrates how to create a custom certificate validation callback to bypass certificate errors for testing purposes (use with caution in production).

using System;
using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;

public class CustomCertificateValidation
{
    public static void Main(string[] args)
    {
        // In a real application, you would likely be using an HttpClient or similar
        // For demonstration, we'll simulate a scenario where we need to bypass validation.

        string url = "https://self-signed.example.com"; // A URL that might have certificate issues

        // Create a ServicePointManager configuration for the specific URL
        // Note: Modifying ServicePointManager affects all HTTP requests in the application domain.
        ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(ValidateServerCertificate);

        try
        {
            // Attempt to make an HTTP request. The custom callback will be used.
            using (WebClient client = new WebClient())
            {
                Console.WriteLine($"Attempting to access: {url}");
                string result = client.DownloadString(url);
                Console.WriteLine("Successfully accessed URL.");
                // Console.WriteLine("Response: " + result); // Uncomment to see response
            }
        }
        catch (WebException ex)
        {
            Console.WriteLine($"An error occurred: {ex.Message}");
            if (ex.Status == WebExceptionStatus.TrustFailure)
            {
                Console.WriteLine("This is likely due to certificate validation failure.");
            }
        }
        finally
        {
            // It's good practice to reset the callback if you only need it for specific operations.
            // In this simple example, it's commented out, but in larger apps, manage scope.
            // ServicePointManager.ServerCertificateValidationCallback = null;
        }
    }

    public static bool ValidateServerCertificate(
        object sender,
        X509Certificate certificate,
        X509Chain chain,
        SslPolicyErrors sslPolicyErrors)
    {
        // *** CAUTION: This is a permissive validation for demonstration only. ***
        // *** Do not use this in production environments without understanding the risks. ***

        Console.WriteLine($"Certificate received: {(certificate as X509Certificate2)?.Subject ?? "Unknown"}");
        Console.WriteLine($"SSL Policy Errors: {sslPolicyErrors}");

        // If there are no errors, the certificate is valid.
        if (sslPolicyErrors == SslPolicyErrors.None)
        {
            Console.WriteLine("Certificate is valid.");
            return true;
        }

        // Handle specific errors you want to allow.
        // For example, allowing untrusted root certificates for testing:
        if ((sslPolicyErrors & SslPolicyErrors.RemoteCertificateChainErrors) != 0)
        {
            Console.WriteLine("Ignoring RemoteCertificateChainErrors. Proceeding with validation...");
            // You could inspect the chain here for specific reasons if needed.
            // For example, if you know the specific root is trusted in your custom store.
            return true; // Allow if only chain errors, and we want to bypass them
        }

        // If there are other errors or we don't want to bypass them, return false.
        Console.WriteLine("Certificate validation failed.");
        return false;
    }
}