Skip to content

Release 1.5.0: validate the registry's server certificate #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ademar merged 1 commit into from
Sep 24, 2026
Merged

Release 1.5.0: validate the registry's server certificate #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions EppLib/EppLib.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
<TargetFrameworks>netstandard2.0;net10.0</TargetFrameworks>
<AssemblyName>EppLib</AssemblyName>
<PackageId>EppLib</PackageId>
<Version>1.4.1</Version>
<Version>1.5.0</Version>
<Authors>Code Maker Inc. and Contributors</Authors>
<Description>EppLib.NET provides a library that makes easy for registrars to interact with registries implementing the Extensible Provisioning Protocol (EPP). Includes extensions for CIRA (.CA), Nominet (.UK), IIS (.SE), Verisign Namestore, LaunchPhase and SecDNS.</Description>
<PackageTags>epp;registrar;registry;domain;rfc5730</PackageTags>
Expand All @@ -13,7 +13,7 @@
<RepositoryUrl>https://github.com/CodeMakerInc/EppLib.NET.git</RepositoryUrl>
<RepositoryType>git</RepositoryType>
<PackageReadmeFile>README.md</PackageReadmeFile>
<PackageReleaseNotes>Connect() now lets the operating system choose the TLS version (SslProtocols.None) instead of forcing TLS 1.0 when a client certificate is used. Recompile against this version to pick up the new default.</PackageReleaseNotes>
<PackageReleaseNotes>Breaking: TcpTransport now validates the registry's server certificate (trusted chain and matching host name) instead of accepting any certificate. For test environments with self-signed certificates, set TcpTransport.ServerCertificateValidationCallback.</PackageReleaseNotes>
<GenerateDocumentationFile>true</GenerateDocumentationFile>
<EnableDefaultCompileItems>false</EnableDefaultCompileItems>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
Expand Down
11 changes: 9 additions & 2 deletions EppLib/TcpTransport.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,14 +58,21 @@ public TcpTransport(string host, int port, X509Certificate clientCertificate, bo
this.clientCertificate = clientCertificate;
}

/// <summary>
/// Overrides how the registry's server certificate is validated. By default the certificate must
/// chain to a trusted root and match the host name. Set this only for test environments that use
/// self-signed certificates, and prefer pinning the expected certificate over accepting any.
/// </summary>
public RemoteCertificateValidationCallback ServerCertificateValidationCallback { get; set; }

/// <summary>
/// Connect to the registry end point
/// </summary>
public void Connect(SslProtocols sslProtocols)
{
var client = new TcpClient(EPP_REGISTRY_COM, PORT);

stream = new SslStream(client.GetStream(), false, ValidateServerCertificate)
stream = new SslStream(client.GetStream(), false, ServerCertificateValidationCallback ?? ValidateServerCertificate)
{
ReadTimeout = READ_TIMEOUT,
WriteTimeout = WRITE_TIMEOUT
Expand All @@ -87,7 +94,7 @@ public void Connect(SslProtocols sslProtocols)

private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
return true;
return sslPolicyErrors == SslPolicyErrors.None;
}

/// <summary>
Expand Down
Loading