How to ignor self signed certificates with System.Net.Http.HttpClient in Universal Windows App

Question

I am creating a Portable Class Library which means I must use System.Net.Http.HttpClient to call my web APIs as far as I understand. The challenge is that for my Universal Windows App, I cannot figure out how to ignore the error that is returned due to the fact the fact the API server can have a self signed certificate. Any suggestions would be greatly appreciated.

UPDATE: I cannot import any certificates as this will be an application that runs on various devices in various organizations and is not practical to have them import a self signed certificate onto every device running the application.

Community · Accepted Answer · 2017-05-23 11:53:26Z

4

Not an option since System.Net.ServicePointManager.CertificatePolicy is not available in UWP. If you use Windows.Web.Http.HttpClient instead, then you can ignore self signed certificates.

UPDATE:

In a second thought, you can ignore self signed certificate errors if you add it to the root certificates of the app.

Two options:

Install it with APIs:

IBuffer buffer = await FileIO.ReadBufferAsync(file);
Certificate rootCert = new Certificate(buffer); 
CertificateStore rootStore = CertificateStores.TrustedRootCertificationAuthorities;
rootStore.Add(rootCert);

Include it in you Package.appxmanifest > Declarations > Certificates > Add and set:
- Store name: root
- Content: path to certificate file

With any of both options, you will stop getting:

System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

edited May 23, 2017 at 11:53

CommunityBot

11 silver badge

answered Jan 16, 2016 at 1:51

kiewic

16.5k14 gold badges85 silver badges104 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

George M Ceaser Jr Over a year ago

Sorry I was not clear about this in the question but I cannot import any certificates as this will be an application that runs on various devices in various organizations and is not practical to have them import a self signed certificate onto every device running the application. I have updated the question to reflect this piece of information.

kiewic Over a year ago

Not sure I understand the reason why your app cannot add a root certificate. But the app is going to add the certificate to the store, not the users, they will not ever know. And the root certificate will be valid just for the app, not for the whole user account or system. The inconvenience is that you need to pack the root certificate with the app at build time or you need to transfer somehow (maybe using a different and valid HTTPS sever) the certificate on execution time. But definitely this is safer than ignoring SSL errors. Ignoring SSL errors could be the same as not having SSL

George M Ceaser Jr Over a year ago

Corrected the question to show that the API server(s) are not mine. The API server will be hosted at each customer's site and each customer will have their own certificate which may be self signed or may be a trusted certificate. That is why I cannot import the certificate,

Benni Over a year ago

@kiewic is there also such a workaround for the System.Net.Http.HttpClient? i tested your second option, but had no success.

kiewic Over a year ago

@Benni This solution should work with both nanmespaces, what version of Windows are you running on?

|

Collectives™ on Stack Overflow

How to ignor self signed certificates with System.Net.Http.HttpClient in Universal Windows App

1 Answer 1

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related