From e8ab1623fca3cf1a806c81927c21324515685fe7 Mon Sep 17 00:00:00 2001
From: Ademar Gonzalez <ademar.gonzalez@gmail.com>
Date: Thu, 24 Sep 2026 19:03:49 -0400
Subject: [PATCH] Validate the registry's server certificate in TcpTransport

ValidateServerCertificate returned true for any certificate, so a
man-in-the-middle could present its own certificate and read the EPP
login credentials. Accept the certificate only when it chains to a
trusted root and matches the host name.

Add TcpTransport.ServerCertificateValidationCallback so test
environments with self-signed certificates can supply their own check.
This is a behavior change for such setups; bump to 1.5.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 EppLib/EppLib.csproj   |  4 ++--
 EppLib/TcpTransport.cs | 11 +++++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/EppLib/EppLib.csproj b/EppLib/EppLib.csproj
index 87f2441..e4f40cb 100644
--- a/EppLib/EppLib.csproj
+++ b/EppLib/EppLib.csproj
@@ -4,7 +4,7 @@
     <TargetFrameworks>netstandard2.0;net10.0</TargetFrameworks>
     <AssemblyName>EppLib</AssemblyName>
     <PackageId>EppLib</PackageId>
-    <Version>1.4.1</Version>
+    <Version>1.5.0</Version>
     <Authors>Code Maker Inc. and Contributors</Authors>
     <Description>EppLib.NET provides a library that makes easy for registrars to interact with registries implementing the Extensible Provisioning Protocol (EPP). Includes extensions for CIRA (.CA), Nominet (.UK), IIS (.SE), Verisign Namestore, LaunchPhase and SecDNS.</Description>
     <PackageTags>epp;registrar;registry;domain;rfc5730</PackageTags>
@@ -13,7 +13,7 @@
     <RepositoryUrl>https://github.com/CodeMakerInc/EppLib.NET.git</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
     <PackageReadmeFile>README.md</PackageReadmeFile>
-    <PackageReleaseNotes>Connect() now lets the operating system choose the TLS version (SslProtocols.None) instead of forcing TLS 1.0 when a client certificate is used. Recompile against this version to pick up the new default.</PackageReleaseNotes>
+    <PackageReleaseNotes>Breaking: TcpTransport now validates the registry's server certificate (trusted chain and matching host name) instead of accepting any certificate. For test environments with self-signed certificates, set TcpTransport.ServerCertificateValidationCallback.</PackageReleaseNotes>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <EnableDefaultCompileItems>false</EnableDefaultCompileItems>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
diff --git a/EppLib/TcpTransport.cs b/EppLib/TcpTransport.cs
index b8bb968..a4d8257 100755
--- a/EppLib/TcpTransport.cs
+++ b/EppLib/TcpTransport.cs
@@ -58,6 +58,13 @@ public TcpTransport(string host, int port, X509Certificate clientCertificate, bo
             this.clientCertificate = clientCertificate;
         }
 
+        /// <summary>
+        /// Overrides how the registry's server certificate is validated. By default the certificate must
+        /// chain to a trusted root and match the host name. Set this only for test environments that use
+        /// self-signed certificates, and prefer pinning the expected certificate over accepting any.
+        /// </summary>
+        public RemoteCertificateValidationCallback ServerCertificateValidationCallback { get; set; }
+
         /// <summary>
         /// Connect to the registry end point
         /// </summary>
@@ -65,7 +72,7 @@ public void Connect(SslProtocols sslProtocols)
         {
             var client = new TcpClient(EPP_REGISTRY_COM, PORT);
 
-            stream = new SslStream(client.GetStream(), false, ValidateServerCertificate)
+            stream = new SslStream(client.GetStream(), false, ServerCertificateValidationCallback ?? ValidateServerCertificate)
                      {
                          ReadTimeout = READ_TIMEOUT,
                          WriteTimeout = WRITE_TIMEOUT
@@ -87,7 +94,7 @@ public void Connect(SslProtocols sslProtocols)
         
         private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
         {
-            return true;
+            return sslPolicyErrors == SslPolicyErrors.None;
         }
 
         /// <summary>