How Can I Ignore Untrusted SSL Certificates When Using HttpClient in .NET Standard?

Bypassing SSL Certificate Validation in .NET Standard using HttpClient

Problem:

Connecting a Windows 8 application to a test web API fails due to untrusted SSL certificates. The goal is to find a workaround similar to the ServerCertificateValidationCallback method used with WebRequest.

Solution:

Here's how to bypass SSL certificate validation with HttpClient in .NET Standard, offering a similar functionality to the WebRequest method:

1. Instantiate HttpClientHandler:

   var handler = new HttpClientHandler();

2. Set ClientCertificateOptions:

   handler.ClientCertificateOptions = ClientCertificateOption.Manual;

3. Implement Custom Certificate Validation: A lambda expression always returning true disables certificate validation:

   handler.ServerCertificateCustomValidationCallback = (_, __, ___, ____) => true;

4. Create HttpClient: Use the modified handler to create the HttpClient instance:

   var client = new HttpClient(handler);

This method allows connection to the test API by ignoring certificate validation. However, it's vital to understand that this significantly reduces security and makes your application vulnerable to man-in-the-middle attacks. Only use this in controlled testing environments and never in production.

The above is the detailed content of How Can I Ignore Untrusted SSL Certificates When Using HttpClient in .NET Standard?. For more information, please follow other related articles on the PHP Chinese website!