Disable SSL certificate verification in default injected IHttpClientFactory

Question

In Startup.cs I inject an IHttpClientFactory service:

services.AddHttpClient();

I can then create a new HttpClient through

public MyClass(IHttpClientFactory httpClientFactory, IOptions<MyClassOptions> options)
{
    _httpClient = httpClientFactory.CreateClient();
    // ...
}

MyClass does some API access; the base URL is passed in the options object.

For testing I set up a dummy instance of the API, which uses a self-signed SSL certificate. Unfortunately, this certificate is (correctly) recognized as invalid:

System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

How can I disable certificate verification at the factory layer, i.e. directly in the ConfigureServices method?

I found this question, but it seemed to use some custom HttpClient implementation (?), while I want to target the default one. The following does not work (DI picks the wrong constructor and subsequently fails):

services.AddHttpClient<IMyClass, MyClass>();

This answer suggests to supply a name for the configured HttpClient, but it passes some magic string, which I would like to avoid (MyClass is located in a class library designed to be also used by others). Passing no name does not work either, since AddHttpClient then merely returns an IServiceCollection object.

janw · Accepted Answer · 2020-07-24 16:32:12Z

13

I figured it out now. We can apply this answer to modify the primary HttpMessageHandler of the default HttpClient:

services.AddHttpClient(Options.DefaultName, c =>
{
    // ...
}).ConfigurePrimaryHttpMessageHandler(() =>
{
    return new HttpClientHandler
    {
        ClientCertificateOptions = ClientCertificateOption.Manual,
        ServerCertificateCustomValidationCallback =
            (httpRequestMessage, cert, certChain, policyErrors) => true
    };
});

This will yield HttpClient objects with disabled SSL verification, whenever the default IHttpClientFactory is injected.

edited Jul 24, 2020 at 16:32

answered Jul 14, 2020 at 16:20

janw

9,90613 gold badges52 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Disable SSL certificate verification in default injected IHttpClientFactory

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related