MAUI - RemoteCertificateValidationCallback error on production #6949

3 Answer(s)

• 

  0

  cbogner85 created 7 months ago

  To add some details what I've already tried: I found out that Android doesn't accept all certificate authorities. Therefore, I added the intermediate certificate to Platforms/Android/Resources/raw and modified network_security_config.xml as described here and here. (Actually my application isn't certified from Let's Encrypt but rather ZeroSSL, as I had to switch for some reason, but certificates are generated using Certify the Web). I also tried to add my certificate and the whole chain, nothing worked out...

  This is what network_security_config.xml looks like:

  

  (of course, productionsite.com is actually replaced with the URL of my production environment)

  This is the folder structure:

  

  Also, network_security_config.xml seems to be correctly attached to AndroidManifest.xml

  

  I also tried to manually install the root and intermediate authorities to the emulator, didn't work either.

  I have no idea what I'm doing wrong...

  PS: Out of curiosity, I tried to set RemoteServices > Default > BaseUrl to microsoft.com (and added microsoft.com to allowed domains in network_security_config.xml). Even then the certificate rejection occurs. Therefore I suspect it's not really a problem with the authority, but something inside MAUI that rejects just every outgoing connection/ certificate.

  Save Cancel
• 

  0

  liangshiwei created 7 months ago

  Support Team Fullstack Developer

  I can even reproduce the behavior by creating a blank ABP project with MAUI enabled and trying to run it locally using ngrok. As long as MAUI connects to localhost, it works. But when I change RemoteService > Default > BaseUrl or Oidc > Options > Authority in MAUIs appsettings.json to ngrok URL, the same certification rejecting error occurs.

  This is because we ignore the localhost HTTPS certificate security check according to: https://learn.microsoft.com/en-us/dotnet/maui/data-cloud/local-web-services?view=net-maui-8.0#bypass-the-certificate-security-check

  

  

  You can try update the GetInsecureHandler method:

  #if ANDROID
      var handler = new HttpClientHandler()
      {
         UseCookies = false
      };
      handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) =>
      {
          if (cert is { Issuer: "CN=localhost" }) // or your productionwebsite.com , you can read it from the appsettings.json
          {
              return true;
          }
  
          return errors == System.Net.Security.SslPolicyErrors.None;
      };
      return handler;
  

  Save Cancel
• 

  0

  cbogner85 created 7 months ago

  Hi liangshiwei,

  thanks for your reply. I can't believe I overlooked that (as I mentioned before, it must have been something completely obvious).

  As far as I unterstood, certificate validation shouldn't be disabled as it makes the app vulnerable to man in the middle attacks. However, this helps as I can see the detailed error now (SslPolicyErrors.RemoteCertificateChainErrors) and hopefully I'll find out how to make Android accept our certificates before going live. And in the meantime, I can test my app on production with the certifcate validation disabled.

  Thanks!

  Save Cancel