SignalR with HTTPS - Invalid Cer

[weirdyang]

If you believe you have an issue that affects the security of the platform please do NOT create an issue and instead email your issue details to secure@microsoft.com. Your report may be eligible for our bug bounty but ONLY if it is reported through email.

Describe the bug

A clear and concise description of what the bug is.

Hi, I'm trying to connect to a server which uses self-signed certificates.
The clients on the tablets are unable to do so, but the clients I deployed on laptops are able to.

This is the error I get when I run my clients on a tablet:

The SSL connection could not be established, see inner exception. --> System.Security.AuthenticationException: The remote certificate is invalid according to the validation procedure

https://stackoverflow.com/questions/48560175/signalr-aspnetcore-unable-to-connect-to-the-remote-server-system-net-webexc
The thread above mentioned .WithWebSocketsOptions, but I am able to access it. What can I do to accept self-signed certificates?

            _connection = new HubConnectionBuilder()
                .WithUrl(_hubRoot, Microsoft.AspNetCore.Http.Connections.HttpTransportType.WebSockets, options =>
                {
                    options.WebSocketConfiguration = sockets =>
                    {
                        sockets.RemoteCertificateValidationCallback += new RemoteCertificateValidationCallback((sender, certificate, chain, policyErrors) => { return true; });
                    };
                })
                .Build();

I have tried to do set a RemoteCertificationValidationCallBack, however it did not solve the issue.

[weirdyang]

Updating this as I've managed to resolve this by adding the certificate to the local user and local machine certificate stores. In particular the following stores:

• Trusted Root Certification Authorities
• Intermediate Certification Authorities’

[blowdart]

You shouldn't need it in Intermediate Certification Authorities, only Trusted Root.

[weirdyang]

I first added it to the trusted root, but I still got the error. Then I added it to the intermediate authorities and then it finally worked. I’m not quite sure why to be honest.

[halter73]

@captmomo Could have the issue be that you added a RemoteCertificateValidationCallback using += instead of replacing the existing one using =?

If you replaced

webSocketOptions.RemoteCertificateValidationCallback += new RemoteCertificateValidationCallback((sender, certificate, chain, policyErrors) => { return true; });

with

webSocketOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, policyErrors) => true;

does that get rid of the AuthenticationException?

[weirdyang]

@halter73

Hi, I will try that later.
Here are the combinations I tried in chronological order;

1. Failed
   webSocketOptions.RemoteCertificateValidationCallback += new RemoteCertificateValidationCallback((sender, certificate, chain, policyErrors) => { return true; });
2. Failed
   webSocketOptions.RemoteCertificateValidationCallback = new RemoteCertificateValidationCallback((sender, certificate, chain, policyErrors) => { return true; });
3. Failed
   webSocketOptions.RemoteCertificateValidationCallback = new RemoteCertificateValidationCallback((sender, certificate, chain, policyErrors) => { return true; });
   Install certificate to Local User Trusted Root certificate Store
4. Failed
   webSocketOptions.RemoteCertificateValidationCallback = new RemoteCertificateValidationCallback((sender, certificate, chain, policyErrors) => { return true; });
   Install certificate to Local User Trusted Root certificate Store
   Install certificate to Local Machine Trusted Root certificate Store
5. Failed
   webSocketOptions.RemoteCertificateValidationCallback = new RemoteCertificateValidationCallback((sender, certificate, chain, policyErrors) => { return true; });
   Install certificate to Local User Trusted Root certificate Store
   Install certificate to Local Machine Trusted Root certificate Store
   Install certificate to Local User Intermediate Certification Authorities
6. Success
   webSocketOptions.RemoteCertificateValidationCallback = new RemoteCertificateValidationCallback((sender, certificate, chain, policyErrors) => { return true; });
   Install certificate to Local User Trusted Root certificate Store
   Install certificate to Local Machine Trusted Root certificate Store
   Install certificate to Local User Intermediate Certification Authorities
   Install certificate to Local Machine Intermediate Certificates Authorities

When I have the time later, I will do more testing to find out what exactly made it work.

[analogrelay]

(Routing to servers since this doesn't seem to be isolated to SignalR)

It definitely seems odd that ading it to the the intermediate authorities worked. Let us know if you can isolate what fix actually resolved the issue.

[xiaoyuvax]

I met the same situation, where:

• .Net Framework implementation works fine with ServicePointManager.ServerCertificateValidationCallback += (sender, certificate, chain, sslPolicyErrors) => true;
• .Net Core 3.0 implementaiton does not work with this CallBack anyway, though it was called upon every connection.

For my library which implements SignalR connection is in .net standard 2.0 and is shared by both .Net Framework and Core 3.0 project, i cannot test the situation as described above by using options.WebSocketConfiguration = sockets => sockets.RemoteCertificateValidationCallback .(available only in .net std 2.1,but not compatible with current top ver of .net framework)

Can someone figure out another workaround?

[analogrelay]

@xiaoyuvax Please file a new issue and include sample code to show how you are configuring the validation callback. This is an old thread and not currently monitored by our triage process.