Unsafe CertificateValidationCallback use.

Using a RemoteCertificateValidationCallback that always returns true is insecure because it allows any certificate to be accepted as valid. This can lead to a variety of security issues, including man-in-the-middle attacks.

Recommendation

Ensure that RemoteCertificateValidationCallback implementations properly verify the certificate before returning true. Avoid implementing callbacks that unconditionally accept all certificates.

Example

The following example demonstrates an insecure use of RemoteCertificateValidationCallback that always returns true:

ServicePointManager.ServerCertificateValidationCallback = 
    (sender, cert, chain, sslPolicyErrors) => true;

A secure approach would involve proper verification of the certificate before returning true:

ServicePointManager.ServerCertificateValidationCallback += 
        (sender, cert, chain, sslPolicyErrors) => {
            if (cert.Issuer == "TrustedIssuer" /* && other conditions */)
                return true;
            return false;
        };

References

• CA5359: Do not disable certificate validation CA5359
• Common Weakness Enumeration: CWE-295.
• Common Weakness Enumeration: CWE-297.