“无法为 SSL/TLS 安全通道建立信任关系。” signalr2.2、https、.net 客户端、自定义证书的异常

Question

I got some exception in testing signalr .net client with custom self-signed certificate.
There was no exception on http.
Is there any problem in setting up the self-signed certificate in my code?
Note that, there is no problem in my certificate file because it runs my https mvc sites well.

server side code : asp.net, azure local fabric

[assembly: OwinStartup(typeof(BookohWebRole.Startup))]
namespace BookohWebRole
{
    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            var hubConfiguration = new HubConfiguration();
            hubConfiguration.EnableDetailedErrors = true;
            hubConfiguration.EnableJavaScriptProxies = false;
            //GlobalHost.HubPipeline.AddModule(new ErrorHandlingPipelineModule());
            app.MapSignalR(hubConfiguration);
        }
    }
}

public class ChatHub : Hub
{
    public override Task OnConnected()
    {
        Trace.TraceInformation("OnConnected");
        var authToken = Context.QueryString.Get("AuthToken");
        Trace.TraceInformation("authToken : " + authToken);
        return base.OnConnected();
    }

    public override Task OnDisconnected(bool stopCalled)
    {
        Trace.TraceInformation("OnDisconnected");
        return base.OnDisconnected(stopCalled);
    }

    public override Task OnReconnected()
    {
        Trace.TraceInformation("OnReconnected");
        var authToken = Context.QueryString.Get("AuthToken");
        Trace.TraceInformation("authToken : " + authToken);
        return base.OnReconnected();
    }

    public void Send(string name, string message)
    {
        Trace.TraceInformation("Context.ConnectionId : " + Context.ConnectionId);
        Clients.All.onSend(name, message);
    }
}

client side code : .net client, unit test method

[TestMethod]
public void chat()
{
    var ev = new AutoResetEvent(false);

    Task.Run(async () =>
    {
        try
        {
            ServicePointManager.DefaultConnectionLimit = 10;
            var queryString = new Dictionary<string, string>();
            queryString.Add("AuthToken", Guid.NewGuid().ToString());

            //https://localhost:44302/
            //http://localhost:22792/

            var hubConnection = new HubConnection("https://localhost:44302/");
            hubConnection.Credentials = CredentialCache.DefaultCredentials;
            hubConnection.AddClientCertificate(X509Certificate.CreateFromCertFile("bookoh.cer"));
            hubConnection.TraceLevel = TraceLevels.All;
            hubConnection.TraceWriter = Console.Out;
            IHubProxy chatHubProxy = hubConnection.CreateHubProxy("ChatHub");
            await hubConnection.Start();

            chatHubProxy.On<string, string>("onSend", (name, message) =>
            {
                Trace.TraceInformation("onSend name : " + name);
                Trace.TraceInformation("onSend message : " + message);
                ev.Set();
            });

            Trace.TraceInformation("chatHubProxy.Invoke");
            await chatHubProxy.Invoke("Send", "hhd2002", "hello");
        }
        catch (Exception ex)
        {
            Trace.TraceInformation("ex : " + ex);
        }
    });

    ev.WaitOne();
}

full exception message on client program

 vstest.executionengine.x86.exe Information: 0 : ex : System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.
 at System.Net.TlsStream.EndWrite(IAsyncResult asyncResult)
 at System.Net.PooledStream.EndWrite(IAsyncResult asyncResult)
 at System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar)

Answer 1

It looks like your actual exception message is

The remote certificate is invalid according to the validation procedure.

This is most likely due to it being self-signed and not signed by a trusted certificate authority. It looks like this has already been answered here:

C# Ignore certificate errors?

Answer 2

I had this issue and it was due to an expired/missing Digi Cert Global Root G2 certificate.

I believe if you raise it with Microsoft they provide you a new certificate, however I just applied it from another machine.

The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel