Validation of X.509 certificates is essential to create secure SSL/TLS sessions not vulnerable to man-in-the-middle attacks.

The certificate chain validation includes these steps:

It’s not recommended to reinvent the wheel by implementing custom certificate chain validation.

TLS libraries provide built-in certificate validation functions that should be used.

Noncompliant Code Example

ServicePointManager.ServerCertificateValidationCallback +=
    (sender, certificate, chain, errors) => {
        return true; // Noncompliant: trust all certificates
    };

Compliant Solution

ServicePointManager.ServerCertificateValidationCallback +=
    (sender, certificate, chain, errors) =>
    {
        if (development) return true; // for development, trust all certificates
        return errors == SslPolicyErrors.None
            && validCerts.Contains(certificate.GetCertHashString()); // Compliant: trust only some certificates
    };

See