Description
A TLS certificate validation callback that always returns true accepts untrusted certificates as well.
Potential impact
- Man-in-the-middle attacks, theft of sensitive information, and communication with an impersonated server.
Remediation
Keep the default certificate validation or accept a certificate only after it passes a clearly defined validation policy.
Examples
Before
csharp
handler.ServerCertificateCustomValidationCallback =
(message, cert, chain, errors) => true;
After
csharp
handler.ServerCertificateCustomValidationCallback =
(message, cert, chain, errors) => errors == SslPolicyErrors.None;
Explanation:
- Before: A callback that accepts every certificate can enable man-in-the-middle attacks.
- After: Retain default validation or accept certificates only when an explicit check, such as
SslPolicyErrors.None, succeeds.