SSL Certificate Validation in Web Services

Sometimes, when you’re at development stage, you create a “self-made” SSL certificate for your sites (IIS in our example);

Such certificate is not “really” valid as the Issuer is not a trusted Certificate Authority (remember, you created it).

When you’re developing a Web Service Client (or WCF Service Client) , Visual Studio creates the proxy for you but he doesn’t care of the issue above.

As soon as you call the Web Service (using an https protocol), you’ll receive

The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

The trick here is writing the following line of code ONCE in your application (at the beginning or, at least, BEFORE calling the Web Service)

ServicePointManager.ServerCertificateValidationCallback += 

new RemoteCertificateValidationCallback(

    (obj, x509cert, chain, policyErrors ) => { return true; }

);

It overrides the method the .NET Framework calls to validate the certificate. In our case we use an anonymous delegate that returns ALWAYS true.

BE AWARE: it exposes you (and your application) to a very high risk if you put such code in production. SSL Certificate MUST BE ALWAYS valid (at least on prod environments ).