VerifyRemoteCertificate()

bool System.Net.Security.SecureChannel.VerifyRemoteCertificate ( RemoteCertificateValidationCallback remoteCertValidationCallback, SslCertificateTrust trust, ref ProtocolToken alertToken, out SslPolicyErrors sslPolicyErrors, out X509ChainStatusFlags chainStatus )

inlinepackage

Definition at line 650 of file SecureChannel.cs.

    {
        sslPolicyErrors = SslPolicyErrors.None;
        chainStatus = X509ChainStatusFlags.NoError;
        bool flag = false;
        X509Chain x509Chain = null;
        X509Certificate2Collection remoteCertificateCollection = null;
        try
        {
            X509Certificate2 remoteCertificate = CertificateValidationPal.GetRemoteCertificate(_securityContext, out remoteCertificateCollection);
            if (_remoteCertificate != null && remoteCertificate != null && remoteCertificate.RawData.AsSpan().SequenceEqual(_remoteCertificate.RawData))
            {
                return true;
            }
            _remoteCertificate = remoteCertificate;
            if (_remoteCertificate == null)
            {
                if (System.Net.NetEventSource.Log.IsEnabled() && RemoteCertRequired)
                {
                    System.Net.NetEventSource.Error(this, $"Remote certificate required, but no remote certificate received", "VerifyRemoteCertificate");
                }
                sslPolicyErrors |= SslPolicyErrors.RemoteCertificateNotAvailable;
            }
            else
            {
                x509Chain = new X509Chain();
                x509Chain.ChainPolicy.RevocationMode = _sslAuthenticationOptions.CertificateRevocationCheckMode;
                x509Chain.ChainPolicy.RevocationFlag = X509RevocationFlag.ExcludeRoot;
                x509Chain.ChainPolicy.ApplicationPolicy.Add(_sslAuthenticationOptions.IsServer ? s_clientAuthOid : s_serverAuthOid);
                if (remoteCertificateCollection != null)
                {
                    x509Chain.ChainPolicy.ExtraStore.AddRange(remoteCertificateCollection);
                }
                if (trust != null)
                {
                    x509Chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
                    if (trust._store != null)
                    {
                        x509Chain.ChainPolicy.CustomTrustStore.AddRange(trust._store.Certificates);
                    }
                    if (trust._trustList != null)
                    {
                        x509Chain.ChainPolicy.CustomTrustStore.AddRange(trust._trustList);
                    }
                }
                sslPolicyErrors |= CertificateValidationPal.VerifyCertificateProperties(_securityContext, x509Chain, _remoteCertificate, _sslAuthenticationOptions.CheckCertName, _sslAuthenticationOptions.IsServer, _sslAuthenticationOptions.TargetHost);
            }
            if (remoteCertValidationCallback != null)
            {
                object ssl = _ssl;
                if (ssl == null)
                {
                    throw new ObjectDisposedException("SslStream");
                }
                flag = remoteCertValidationCallback(ssl, _remoteCertificate, x509Chain, sslPolicyErrors);
            }
            else
            {
                if (!RemoteCertRequired)
                {
                    sslPolicyErrors &= ~SslPolicyErrors.RemoteCertificateNotAvailable;
                }
                flag = sslPolicyErrors == SslPolicyErrors.None;
            }
            if (System.Net.NetEventSource.Log.IsEnabled())
            {
                LogCertificateValidation(remoteCertValidationCallback, sslPolicyErrors, flag, x509Chain);
                System.Net.NetEventSource.Info(this, $"Cert validation, remote cert = {_remoteCertificate}", "VerifyRemoteCertificate");
            }
            if (!flag)
            {
                alertToken = CreateFatalHandshakeAlertToken(sslPolicyErrors, x509Chain);
                if (x509Chain != null)
                {
                    X509ChainStatus[] chainStatus2 = x509Chain.ChainStatus;
                    foreach (X509ChainStatus x509ChainStatus in chainStatus2)
                    {
                        chainStatus |= x509ChainStatus.Status;
                    }
                }
            }
        }
        finally
        {
            if (x509Chain != null)
            {
                int count = x509Chain.ChainElements.Count;
                for (int j = 0; j < count; j++)
                {
                    x509Chain.ChainElements[j].Certificate.Dispose();
                }
                x509Chain.Dispose();
            }
            if (remoteCertificateCollection != null)
            {
                int count2 = remoteCertificateCollection.Count;
                for (int k = 0; k < count2; k++)
                {
                    remoteCertificateCollection[k].Dispose();
                }
            }
        }
        return flag;
    }

References System.Net.Security.SecureChannel._remoteCertificate, System.Net.Security.SecureChannel._securityContext, System.Net.Security.SecureChannel._ssl, System.Net.Security.SecureChannel._sslAuthenticationOptions, System.Collections.Generic.Dictionary< TKey, TValue >.Add(), System.Collections.Generic.Dictionary< TKey, TValue >.AddRange(), System.Net.Security.SslAuthenticationOptions.CertificateRevocationCheckMode, System.Net.Security.SslAuthenticationOptions.CheckCertName, System.count, System.Collections.Generic.Dictionary< TKey, TValue >.Count, System.Net.Security.SecureChannel.CreateFatalHandshakeAlertToken(), System.Net.NetEventSource.Error(), System.Net.CertificateValidationPal.GetRemoteCertificate(), System.Net.NetEventSource.Info(), System.Net.Security.SslAuthenticationOptions.IsServer, System.Net.NetEventSource.Log, System.Net.Security.SecureChannel.LogCertificateValidation(), System.Security.Cryptography.X509Certificates.X509Certificate2.RawData, System.Net.Security.SecureChannel.RemoteCertRequired, System.Net.Security.SecureChannel.s_clientAuthOid, System.Net.Security.SecureChannel.s_serverAuthOid, System.Net.Security.SslAuthenticationOptions.TargetHost, and System.Net.CertificateValidationPal.VerifyCertificateProperties().

Referenced by System.Net.Security.SslStream.CompleteHandshake().