Is disabling Validate certificate chain safe ?

Question

Hi, we encounter such error while test calling backend service from APIM management plane and already found a workaround.

The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.",
"The remote certificate is invalid according to the validation procedure

Workaround :
Disable Validate certificate chain and Validate certificate name from Backends > Properties , the error is gone.

One question here
Is the workaround safe ? Azure resource shows http in protocol which concerns us if this way uses insecure HTTP instead of HTTPS for data transmission.

Need your advice, thank you

Answer 1

Depends. Do you trust the cert chain up to the root? If you do then it is safe to turn it off and it'll speed up things a little. However that also means that if somebody somewhere along the way injects a bogus cert in the chain (not sure how'd they actually do that on APIM though) then you'd never know. Personally I think you should figure out why the higher level cert(s) is/aren't valid. Did somebody use the wrong one? Have you been hacked? Disabling validation chains should be a last resort and only perhaps in sandbox/test environments where you're dealing with non-sensitive data.

You definitely don't want to use HTTP in your APIs (or websites either). The docs say this can be either http or https so you should be using https. Otherwise the cert validation isn't useful.