SslPolicyErrors in Custom Certificate Validation Callback

28 Views Asked by At

I'm writing a sample C# code to implement mTLS authentication with RestSharp.

Here is my code

using System;
using System.Net;
using RestSharp;
using System.Security.Cryptography.X509Certificates;

class Program
{
    private X509Certificate2Collection caChainCertificates;

    static void Main(string[] args)
    {

            // Load CA chain certificate
            caChainCertificates = new X509Certificate2Collection();
            caChainCertificates.Import(@"..\ca-chain.cert.pem");

            X509Certificate2 clientCertificate = new 
            X509Certificate2(@"..\certificate.pfx", "******");


            var client = new RestClient("https://apiurl:port"); 
            client.ClientCertificates = new X509CertificateCollection { clientCertificate };

            var request = new RestRequest("/testresource", Method.POST); 

            ServicePointManager.ServerCertificateValidationCallback = ValidateServerCertificate;

            IRestResponse response = client.Execute(request);

            if (response.StatusCode == HttpStatusCode.OK)
            {
                Console.WriteLine("Request successful");
                Console.WriteLine("Response content: " + response.Content);
            }
            else
            {
                Console.WriteLine("Request failed with status code: " + response.StatusCode);
                Console.WriteLine("Error message: " + response.ErrorMessage);
            }
    }

private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    if (sslPolicyErrors == SslPolicyErrors.None)
    {
        // No SSL policy errors, the certificate is considered valid
        return true;
    }

    // Check if any errors in the certificate chain
    if (chain == null || chain.ChainStatus == null)
    {
        // Certificate chain is not available or invalid
        return false;
    }

    // Check each chain status
    foreach (X509ChainStatus status in chain.ChainStatus)
    {
        if (status.Status != X509ChainStatusFlags.NoError)
        {
            // There is an error in the certificate chain, so it's considered invalid
            return false;
        }
    }


    // If we've reached here, the certificate chain is valid, but SSL policy errors are present
    // If you want to accept certificates with SSL policy errors, uncomment the line below
    //return true;

    // Otherwise, we consider the certificate invalid if SSL policy errors are present
    return false;
}

}

However, I get below SslPolicyErrors in the ValidateServerCertificate callbak

enter image description here

I tried to troubleshoot these statuses but couldn't find much info.

Can anyone please suggest why the code fails validate the ServerCertificate.

My application is targeting .NET framework 4.7

Same certificates work when I try via Postman

0

There are 0 best solutions below