Azure Hosted Service Bus : “The X.509 certificate CN=servicebus.windows.net is not in the trusted people store.”

Question

Using Azure SDK 2.3 on my vs2013 development VM I can consume Service Bus queues hosted in Azure painlessly. However, on Windows Server 2008 R2 Standard SP1

Answer 1

To eliminate certificate trust issues from Service Bus for Windows Server, use the following:

Create a list of the certificates you trust:

    var trustedCertificates = new HashSet(new[]
    {
        "1245…",
        "4567…, 
        "8102…" 
    }, StringComparer.OrdinalIgnoreCase);

Trust those:

    ServicePointManager.ServerCertificateValidationCallback = (sender, certificate, chain, errors) =>
    {
        if (errors == SslPolicyErrors.None)
        {
            return true;
        }

        var hashString = certificate.GetCertHashString();
        var isTrusted = trustedCertificates.Contains(hashString);

        if (!isTrusted)
        {
            telemetryClient.TrackTrace($"Untrusted: {hashString} Errors: {errors} Cert: {certificate.ToString()}", SeverityLevel.Warning);
        }

        return isTrusted;
    };

Calm Service Bus down too:

    private static void SetCertificateValidator()
    {
        var retriableCertificateValidatorType = Type.GetType("Microsoft.ServiceBus.Channels.Security.RetriableCertificateValidator, Microsoft.ServiceBus", true, false);
        var instanceProperty = retriableCertificateValidatorType.GetProperty("Instance", BindingFlags.Static | BindingFlags.NonPublic);
        var instance = instanceProperty.GetValue(null);

        var peerOrChainTrustNoCheck = retriableCertificateValidatorType.GetField("peerOrChainTrustNoCheck", BindingFlags.Instance | BindingFlags.NonPublic);
        peerOrChainTrustNoCheck?.SetValue(instance, new EmptyOpX509CertificateValidator());
    }

    private sealed class EmptyOpX509CertificateValidator : X509CertificateValidator
    {
        public override void Validate(X509Certificate2 certificate)
        {
        }
    }