ASP.NET Core HttpClient accept all certificates for localhost only, otherwise behave normally

Question

I'm trying to replicate the normal certificate validation for anything other than requests to localhost

    public static readonly HttpClient _httpClient = new HttpClient(new HttpClientHandler()
    {
        AllowAutoRedirect = false,
        MaxConnectionsPerServer = int.MaxValue,
        UseCookies = false,
        ServerCertificateCustomValidationCallback = ValidateLocalhostCertificate
    });

    private static bool ValidateLocalhostCertificate(HttpRequestMessage arg1, X509Certificate2 arg2, X509Chain arg3, SslPolicyErrors arg4)
    {
        if (arg1.RequestUri.Host == "127.0.0.1")
        {
            return true;
        }
        else
        {
            // default validation
        }
    }

I'm writing an ASP.NET Core application using this answer to reverse proxy requests made from specific subdomains to local services (e.g. 1.mywebsite.com goes to 127.0.0.1:1001, 2.mywebsite.com goes to 127.0.0.1:1002, etc.)

PLEASE don't suggest IIS URL rewrites or any other method for doing this

I'm assuming that client => mywebsite over 443 is secure, and the only 'unsecure' bit using the answer linked above would be happening locally on the server when it ignores invalid certificates to the local services (which all run strictly on https, something I can't change) - if this is untrue please correct me!

I've tried scouring the core source code but I'm struggling to find how HttpClient typically validates certificates

Or you can sign and install your own localhost cert and not mess with the code. — Jasen
– Jasen, Commented Nov 16, 2018 at 20:22
@Jasen I originally tried that and it didn't work. I'll give it another go on monday in case I had done something wrong — p3tch
– p3tch, Commented Nov 16, 2018 at 21:24
@Jasen yeah, no System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. — p3tch
– p3tch, Commented Nov 19, 2018 at 10:33

Igor Goyda · Accepted Answer · 2018-11-21 13:08:07Z

1

Runtime checks certificate before a call to callback.

So certificate already checked and you can just check arg4 for error.

answered Nov 21, 2018 at 13:08

Igor Goyda

2,1377 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.NET Core HttpClient accept all certificates for localhost only, otherwise behave normally

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related