Handling Untrusted SSL Certificates with HttpClient in Windows 8 Applications

Problem Background and Challenges

During Windows 8 application development, developers frequently need to communicate with test web APIs over HTTPS. However, test servers often use self-signed or untrusted SSL certificates, causing HttpClient to throw security exceptions when establishing secure connections. Traditional solutions like ServicePointManager.ServerCertificateValidationCallback face compatibility issues in the Windows Runtime environment and cannot be used directly.

Native Solutions in Windows 8.1

With the release of Windows 8.1, Microsoft introduced native support for handling untrusted SSL certificates. Developers can choose between two main approaches:

Using Windows.Web.HttpClient

Windows 8.1 introduced the Windows.Web.HttpClient class, specifically designed for Windows Store applications with built-in support for untrusted certificates:

var httpClient = new Windows.Web.Http.HttpClient();
// By default, Windows.Web.HttpClient accepts self-signed certificates
var response = await httpClient.GetAsync(new Uri("https://localhost:5001/api/test"));

The advantage of this approach is that it requires no additional configuration, but the API differs from the traditional System.Net.Http.HttpClient, which may require code adjustments.

Using Adapter Pattern

For developers who prefer to continue using System.Net.Http.HttpClient, Oren Novotny provides an excellent solution with the WinRtHttpClientHandler adapter:

// First install WinRtHttpClientHandler via NuGet
// Install-Package WinRtHttpClientHandler

var handler = new WinRtHttpClientHandler();
var client = new System.Net.Http.HttpClient(handler);
var response = await client.GetAsync("https://localhost:5001/api/test");

This adapter uses the Windows Runtime HTTP stack underneath while providing the familiar System.Net.Http.HttpClient interface, offering the best of both worlds.

Comparison of Alternative Solutions

HttpClientHandler Custom Validation

In .NET versions supporting HttpClientHandler.ServerCertificateCustomValidationCallback, you can implement it as follows:

var handler = new HttpClientHandler() 
{ 
    ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
};

var client = new HttpClient(handler);
var response = await client.GetAsync("https://localhost:5001/api/test");

WebRequestHandler Approach

For scenarios requiring finer control, WebRequestHandler can be used:

using (var handler = new WebRequestHandler())
{
    handler.ServerCertificateValidationCallback = (sender, certificate, chain, sslPolicyErrors) => true;
    
    using (var client = new HttpClient(handler))
    {
        var response = await client.GetAsync("https://localhost:5001/api/test");
    }
}

Security Considerations and Best Practices

While the above solutions are very useful in test environments, they require careful consideration in production:

• Test Environment Only: These solutions should only be used in development and test environments; production must use valid SSL certificates
• Principle of Least Privilege: Even when accepting untrusted certificates, limit accessible domains and IP ranges
• Code Review: Ensure that code accepting any certificate is removed from production builds
• Alternative Approaches: Consider using valid test certificates or configuring local certificate trust chains

Practical Application Scenarios

Referencing similar issues in the Elasticsearch-net project, when connecting to Elasticsearch instances using Jetty SSL, the same certificate trust issues arise. This demonstrates that this is a universal challenge across technology stacks, and the solutions have broad applicability.

Conclusion

Windows 8.1 provides multiple solutions for handling untrusted SSL certificates, allowing developers to choose the most appropriate approach for their specific needs. For new projects, Windows.Web.HttpClient is recommended; for migrating existing projects, the WinRtHttpClientHandler adapter provides a smooth transition. Regardless of the chosen solution, security best practices must be followed to ensure production environment safety.