"The remote certificate is invalid according to the verification procedure" using HttpClient

Question

Cannot resolve certificate verification issue.

There is a web API server that uses HTTPS to process requests. The server certificate has this certification path: RCA (root) → ICA (intermediate) → web API server. RCA, ICA, and Web API servers are members of the same Active Directory domain.

The client application (desktop, computer is connected to the same domain) uses HttpClient to communicate with the server and supports two scenarios:

• connected to the corporate network;
• disconnected from the corporate network (Internet access).

Both scenarios use basic authentication.
RCA and ICA certificates are placed in the "trusted root certification authorities" and "Intermediate certification authorities" respectively for the local computer account. RCA certificate is self-signed.

Now that the client is connected to the corporate network, certificate verification works as expected, and the user can "talk" with the web API.

When the client is disconnected (only an Internet connection is available), certificate verification fails with an AuthenticationException ("The remote certificate is not valid according to the verification procedure").

I do not want to completely disable certificate verification, but I just need to tell the verification system that this certificate is valid. In addition, the client application uses SignalR, which by default uses its own transport. Therefore, this and this are not parameters.

Why doesn't placing RCA ICA certificates in the "Trusted ..." and "Intermediate ..." folders help?

Is there a workaround?

Answer 1

The problem you are having is that the CN theme represented by the certificate does not match the host name in Uri.

Make sure that the certificate bound to the host’s public IP address has the corresponding CN with the host name that you use to access the resource.

For easy verification, open Url in a browser and view the certificate. The Issued to field must contain the fully qualified domain name and match the part of the host name in Uri. In your case, this is not so.

Answer 2

Paste this piece of code into the body of the procedure:

 static void Main(string[] args) { ServicePointManager.ServerCertificateValidationCallback = delegate (object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) { return true; }; .... }