问：C# API 无法为 SSL/TLS 安全通道建立信任关系

Question

I just got the following error while calling an API. "Could not establish trust relationship for the SSL/TLS secure channel"

I fixed it with the RemoteCertificateValidationCallback class:

ServicePointManager.ServerCertificateValidationCallback += 
            new RemoteCertificateValidationCallback(Helpers.CertificateHelper.ValidateCertificates);

And there I just applied a snippet of code found here: How to verify X509 cert without importing root cert?

Now its working fine, but.. Is this the way to go? Is it okay, or should I not use this method?

Answer 1

When your server checks the certificates on a request it will try to verify the entire certificate chain. The code you used basically tells your server to skip validating the root ca. You should not do that because as Crypt32 said it leaves you more vulnerable to attacks.

If the error you receive tells you that you are missing the root certificates you should make sure that your server trusts those certificates

If this is a windows server you can install them in the Trusted Root Certification Authorities - Theres an explantion about it here

Be careful about which certificates you trust - make sure that your source can be trusted

If that does not work, you should post here the exact error you are getting and we might be able to understand the problem better