How am I supposed to implement server certificate checks in the LdapSessionOptions.VerifyServerCertificate callback without access to a populated SslPolicyErrors?
I noticed that SslStream, via SecureChannel, performs certificate validation that returns a complete set of policy errors. The routine it calls appears to be internal/private and based on complicated interop that I doubt I'm supposed to duplicate.
I know that X509Certificate2 can provide a pass/fail answer. But, that runs only the X509Chain status checks, which does not include, for example, "RemoteCertificateNameMismatch".
private bool VerifyServerCertificate(LdapConnection connection, X509Certificate certificate)
{
var certificate2 = new X509Certificate2(certificate);
return certificate2.Verify();
}I could build an X509Chain and enumerate status, but that still misses the (few) other validations from SslPolicyErrors. And now I'm responsible for managing two extra disposable resources (although I'm not sure I can dispose them because each contains the original certificate that was passed in and I don't dare dispose that early).
private bool VerifyServerCertificate(LdapConnection connection, X509Certificate certificate)
{
var certificate2 = new X509Certificate2(certificate);
var chain = new X509Chain();
if (chain.Build(certificate2))
{
return true;
}
foreach (var element in chain.ChainElements)
{
foreach (var status in elements.ChainElementStatus)
{
// ... log something
}
}
return false;
}
How am I supposed to implement server certificate checks in the
LdapSessionOptions.VerifyServerCertificatecallback without access to a populatedSslPolicyErrors?I noticed that
SslStream, viaSecureChannel, performs certificate validation that returns a complete set of policy errors. The routine it calls appears to be internal/private and based on complicated interop that I doubt I'm supposed to duplicate.I know that
X509Certificate2can provide a pass/fail answer. But, that runs only theX509Chainstatus checks, which does not include, for example, "RemoteCertificateNameMismatch".I could build an
X509Chainand enumerate status, but that still misses the (few) other validations fromSslPolicyErrors. And now I'm responsible for managing two extra disposable resources (although I'm not sure I can dispose them because each contains the original certificate that was passed in and I don't dare dispose that early).