3

I'm working on a Windows Phone 7 application that makes a REST service call. The third party that hosts the web services has an invalid certificate in the current environment. When I hit the URL in Firefox, I get a warning about the cert and I am asked if I want to continue. I'm also using the Poster FF extension to test the call. It works with Poster if I first accept the invalid cert in Firefox. If I don't, then POSTER wont make the request.

In my WP7 Emulator, I can't make the request at all. I get a 404 at the EndGetResponse method. I making the same request as in Poster, so I know there is nothing wrong with the request. I have successfully hit another web service using the same code (no certs involved), so I don't think it's the code. The only thing I can think of is that WP7 doesn't allow requests to an invalid cert. Has anyone had experience with this situation? Is there any way around it?

Is there a way I can tell my app to accept all communication, even if there is an invalid cert?

CACuzcatlan
  • 5,407
  • 8
  • 41
  • 59

3 Answers3

1

There is sadly no way to do this on the phone. Ordinarily, i.e. on the desktop this simple line of code will disable certificate checking.

System.Net.ServicePointManager.ServerCertificateValidationCallback = (se, cert, chain, sslError) => { return true; };

If you look at the ServicePointManager on the phone, there's no callback to hook into. It's a massive pain in the arrrrse.

Have you considered writing to the service owner and asking why they're being bad internet citizens? (essentially, what you're seeing here is web security in action, for better or worse)

As Matt says, you might be able to code a simple relay on a web server. It doesn't have to be a special service, but maybe just a web page that does the call for you and spits out RAW text or XML. Your phone client just GETs this page and picks through the response manually.

Where there's a will there's a way.

Luke

Luke Puplett
  • 42,091
  • 47
  • 181
  • 266
1

You need to install the root CA cert of the issuing party on the phone.

You can do this by emailing the RootCA to the user of the phone. They click on the attachement and it will prompt them to ask if they want to install the certificate on the phone.

Once you have done that your requests should go through.

I dont believe there is a way to do this programatically in your app however.

Chris Johnson
  • 1,230
  • 7
  • 15
0

I'm not aware of a way to install additional certificates on the phone.

In this situation I'd create a proxy service between your app and the 3rd party site and have your app call that. If you need to, you could put the proxy behind a valid cert.

Matt Lacey
  • 65,560
  • 11
  • 91
  • 143