WCF Gotcha: Disabling SSL Validation

@YaronNaveh

When you use SSL with WCF or .Net 2.0 web services you might get this exception:

SecurityNegotiationException:

Could not establish trust relationship for the SSL/TLS secure channel with authority 'localhost'.

This means that the X.509 certificate that the server presented is not valid according to your client's trust chain. the trust chain is the list of certificate issuers that you trust. In many cases this means you should not trust this web service. In some cases you decide to trust it anyway, due to the fact that you know the author or are still in early testing stages. You have two options:

Option 1 - Make the certificate valid
You would need to have the server certificate or its issuer's certificate in the trusted certificates store of your client. This can be done using WinHttpCertCfg.exe or using the "mmc" console.

Option 2 - Configure WCF/.Net 2.0 to not validate the certificate
With WCF, a common gotcha is to try and achieve that by setting:

<serviceCertificate>
<authentication certificateValidationMode="None" />
</serviceCertificate>

However this will not work with transport level security (SSL) but only with message level security. The correct way to do it is the same one as with .Net 2.0 web services. Just add this code before calling the service:

using System.Net;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;
...
ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(OnValidationCallback);
...
public static bool OnValidationCallback(object sender, X509Certificate cert, X509Chain chain, SslPolicyErrors errors)
{
return true;
}

@YaronNaveh

What's next? get this blog rss updates or register for mail updates!