diff --git a/EppLib/EppLib.csproj b/EppLib/EppLib.csproj
index 87f2441..e4f40cb 100644
--- a/EppLib/EppLib.csproj
+++ b/EppLib/EppLib.csproj
@@ -4,7 +4,7 @@
     <TargetFrameworks>netstandard2.0;net10.0</TargetFrameworks>
     <AssemblyName>EppLib</AssemblyName>
     <PackageId>EppLib</PackageId>
-    <Version>1.4.1</Version>
+    <Version>1.5.0</Version>
     <Authors>Code Maker Inc. and Contributors</Authors>
     <Description>EppLib.NET provides a library that makes easy for registrars to interact with registries implementing the Extensible Provisioning Protocol (EPP). Includes extensions for CIRA (.CA), Nominet (.UK), IIS (.SE), Verisign Namestore, LaunchPhase and SecDNS.</Description>
     <PackageTags>epp;registrar;registry;domain;rfc5730</PackageTags>
@@ -13,7 +13,7 @@
     <RepositoryUrl>https://github.com/CodeMakerInc/EppLib.NET.git</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
     <PackageReadmeFile>README.md</PackageReadmeFile>
-    <PackageReleaseNotes>Connect() now lets the operating system choose the TLS version (SslProtocols.None) instead of forcing TLS 1.0 when a client certificate is used. Recompile against this version to pick up the new default.</PackageReleaseNotes>
+    <PackageReleaseNotes>Breaking: TcpTransport now validates the registry's server certificate (trusted chain and matching host name) instead of accepting any certificate. For test environments with self-signed certificates, set TcpTransport.ServerCertificateValidationCallback.</PackageReleaseNotes>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <EnableDefaultCompileItems>false</EnableDefaultCompileItems>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
diff --git a/EppLib/TcpTransport.cs b/EppLib/TcpTransport.cs
index b8bb968..a4d8257 100755
--- a/EppLib/TcpTransport.cs
+++ b/EppLib/TcpTransport.cs
@@ -58,6 +58,13 @@ public TcpTransport(string host, int port, X509Certificate clientCertificate, bo
             this.clientCertificate = clientCertificate;
         }
 
+        /// <summary>
+        /// Overrides how the registry's server certificate is validated. By default the certificate must
+        /// chain to a trusted root and match the host name. Set this only for test environments that use
+        /// self-signed certificates, and prefer pinning the expected certificate over accepting any.
+        /// </summary>
+        public RemoteCertificateValidationCallback ServerCertificateValidationCallback { get; set; }
+
         /// <summary>
         /// Connect to the registry end point
         /// </summary>
@@ -65,7 +72,7 @@ public void Connect(SslProtocols sslProtocols)
         {
             var client = new TcpClient(EPP_REGISTRY_COM, PORT);
 
-            stream = new SslStream(client.GetStream(), false, ValidateServerCertificate)
+            stream = new SslStream(client.GetStream(), false, ServerCertificateValidationCallback ?? ValidateServerCertificate)
                      {
                          ReadTimeout = READ_TIMEOUT,
                          WriteTimeout = WRITE_TIMEOUT
@@ -87,7 +94,7 @@ public void Connect(SslProtocols sslProtocols)
         
         private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
         {
-            return true;
+            return sslPolicyErrors == SslPolicyErrors.None;
         }
 
         /// <summary>