Add option to HttpClientHandler to validate certificates against custom root certificate authorities #21378
Labels
api-suggestion
Early API idea and discussion, it is NOT ready for implementation
area-System.Net.Http
os-mac-os-x
macOS aka OSX
Milestone
To validate a server certificate against a set of root certificates (instead of the system certificates), we are now limited to using ServerCertificateCustomValidationCallback. Unfortunately this callback does not work on all systems due to incompatibilities described in #17723, and it seems there are some blockers to fixing them on some platforms.
It may be easier for users to just be able to provide a file path to a set of root certificates (encoded as PEM), or have another API to provide custom root certificates to use for validation instead of the system root certificates.
One idea suggested in https://github.com/dotnet/corefx/issues/9728#issuecomment-297201090 is:
Another option would be to provide custom instances of
X509Certificate2
.The text was updated successfully, but these errors were encountered: