HTTPs SAN field and CA validation

Question

Hi All,

We have an HTTPs client application built on .Net Framework 4.8.

In this application, we are trying to validate the certificate using the code attached in the question.Https_Server_Callback.txt

public bool AcceptAllCertifications(object sender, System.Security.Cryptography.X509Certificates.X509Certificate certification, System.Security.Cryptography.X509Certificates.X509Chain chain, System.Net.Security.SslPolicyErrors sslPolicyErrors)
{
    if (sslPolicyErrors == SslPolicyErrors.None)
    {
        return true;
    }
    else
    {
        return false;
    }
}

However, the below two checks are failing:

1. The SAN field is not validated. If we have an incorrect IP address in the SAN field of the server certificate, the server callback method is returning true. It should have actually returned false as the SAN field has an incorrect IP address.
2. If the CA certificate is missing on the server, the server callback method is returning true. It should have actually returned false as the CA certificate is missing on the server.

Is there any way that we can validate the above two conditions correctly.

Please help us on this!!

Answer 1

Hi @S Abijith , Welcome to Microsoft Q&A,

You don't seem to know how to verify the certificate, I found the following example. Try it out, and let me know if you encounter errors and provide information.

public bool ValidateCertificate(object sender, System.Security.Cryptography.X509Certificates.X509Certificate certificate, System.Security.Cryptography.X509Certificates.X509Chain chain, System.Net.Security.SslPolicyErrors sslPolicyErrors)
{
    if (sslPolicyErrors == SslPolicyErrors.None)
    {
        // Check if the certificate has the correct IP address in the SAN field
        string expectedIpAddress = "correct_ip_address"; // Replace with the correct IP address
        bool sanValid = false;

        foreach (var extension in certificate.Extensions)
        {
            if (extension is System.Security.Cryptography.X509Certificates.X509Extension sanExtension && sanExtension.Oid.Value == "2.5.29.17") // OID for Subject Alternative Name
            {
                var rawData = sanExtension.RawData;
                // Parse rawData to extract IP addresses and host names from SAN extension
                // Compare with expectedIpAddress

                if (/* SAN contains the expected IP address */)
                {
                    sanValid = true;
                    break;
                }
            }
        }

        if (!sanValid)
        {
            return false;
        }

        // Check if the CA certificate is present on the server
        bool caCertificatePresent = /* Logic to check if CA certificate is present */;
        if (!caCertificatePresent)
        {
            return false;
        }

        return true; // All checks passed
    }
    else
    {
        return false; // There are other SSL policy errors
    }
}

private System.Security.Cryptography.X509Certificates.X509Certificate2 LoadExpectedCaCertificate()
{
    // Load the CA certificate from a file (replace with your actual file path)
    string caCertificateFilePath = "path_to_ca_certificate.cer"; // Replace with your actual file path
    try
    {
        // Load the CA certificate from the file
        X509Certificate2 caCertificate = new X509Certificate2(caCertificateFilePath);
        return caCertificate;
    }
    catch (Exception ex)
    {
        // Handle any errors that might occur during certificate loading
        Console.WriteLine($"Error loading CA certificate: {ex.Message}");
        return null;
    }
}

Best Regards,

Jiale

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.