sslStream.AuthenticateAsServer忽略RemoteCertificateValidationCallback

Question

I'm trying to fix an existing .Net 2.0 service/application.

It's a TCP server that accepts SSL/TLS connections. Operates over port 443, as expected. It is used to respond to Yealink provisioning requests. You can pop the url in the phone, and it will get the settings etc (anyway not important.)

The problem is that when older phones request this service it works fine, but now, since the new versions of the phones, it does not work.

This is the code that fials:

using (SslStream sslStream = new SslStream(tcpClient.GetStream(), false, new RemoteCertificateValidationCallback(AcceptAllCertifications)))
{
    X509Certificate c = new X509Certificate2("cert.pfx", "XXXX");
    sslStream.AuthenticateAsServer(c, false, SslProtocols.Tls, false);

    // Process request etc
}

and this is the "AcceptAllCertifications"

private bool AcceptAllCertifications(object sender, X509Certificate certification, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
    return true;
}

New phones cause the app to produce an error on sslStream.AuthenticateAsServer(...);

System.componentmodel.win32exception: the certificate chain was issued by an authority that is not trusted.

Is, "the certificate" they mention here my certificate (one on server) or their certificate (one sent from phone)?

I have no idea (and will never have any idea) about the kind of certificate sent by the users phone.

The certificate "cert.pfx" (my certificate) was bought from DigiCert, (its a wildcard certificate). It was exported with a password, and oh yea, did i mention this works absolutely fine with all regular browsers and older phones... just not the Yealink's new phones.

How do i just skip the entire authentication thing, i just want it to work, its not a public system? With the new phones the "RemoteCertificateValidationCallback(AcceptAllCertifications)" is never called, i have followed this with the debugger, its skipped out completely.

Edit:

Answer 1

I just read up on intermediate certificates (my memory failed during an earlier comment above) and I think I know what the problem is: Your phone already trusts the DigiCert root certificate at the top of the trust chain but neither your server nor your phone know anything about the intermediate cert, which the cert utility shows. You need to install the public key of the intermediate certificate on your server, too, in addition to the server certificate for which you have the private key. Here is a helpful link that explains the function of intermediate certs in more detail: SSL Installing Intermediate Certificates

I quote:

The intermediate certificate, or certificates, completes the chain to a root certificate trusted by the browser. During SSL negotiation, the server sends the trust chain to the client to assist the client in building and verifying the trust chain.

The page also contains instructions on how to test whether the necessary intermediate certs are correctly installed on your web server.