If certificate is valid (trusted authority and so on), it will create connection just fine without any tricks. Article you pointed concerns only and only client certificates (and in this case there were not them in use). For example this works fine:
Dim objReq As HttpWebRequest = WebRequest.Create("https://www.verisign.com/cgi-bin/clearsales_cgi/leadgen.htm?form_id=0110&toc=w252677830110000&email=")
Dim objResp As HttpWebResponse = CType(objReq.GetResponse(), HttpWebResponse)
Dim reader As New IO.StreamReader(objResp.GetResponseStream)
Dim str As String = reader.ReadToEnd
reader.Close()
objResp.Close()
Response.Write(str)
If
issuer is non-trusted authority and you connect to there, I understand the non-secure point but if you know the issuer or if it is yourself (you create client applications also), this approach is just fine. Point is to make the traffic encrypted and even with
self-issued certificates it is just that. The certificate validation class does not prevent the connection to be secure in encrypted way it just validates if the certificate itself is valid. Certainly invalid certificates are security risk, but if the only
"problem" is just that you yourself are not trusted authority but certificate is otherwise OK it is no more security risk than using any other certificate (certificate of trusted root authority).
joteke
All-Star
46284 Points
6896 Posts
ASPInsiders
MVP
Re: Please Help!! "Could not establish trust relationship" using SSL
Oct 23, 2002 04:26 PM|LINK
Dim objReq As HttpWebRequest = WebRequest.Create("https://www.verisign.com/cgi-bin/clearsales_cgi/leadgen.htm?form_id=0110&toc=w252677830110000&email=") Dim objResp As HttpWebResponse = CType(objReq.GetResponse(), HttpWebResponse) Dim reader As New IO.StreamReader(objResp.GetResponseStream) Dim str As String = reader.ReadToEnd reader.Close() objResp.Close() Response.Write(str)If issuer is non-trusted authority and you connect to there, I understand the non-secure point but if you know the issuer or if it is yourself (you create client applications also), this approach is just fine. Point is to make the traffic encrypted and even with self-issued certificates it is just that. The certificate validation class does not prevent the connection to be secure in encrypted way it just validates if the certificate itself is valid. Certainly invalid certificates are security risk, but if the only "problem" is just that you yourself are not trusted authority but certificate is otherwise OK it is no more security risk than using any other certificate (certificate of trusted root authority).Teemu Keiski
Finland, EU