Connect to site with self-signed certificate

[gregor-tusar]

Describe the bug
I'm trying to connect uSync.Publisher to a internal instance that is using self-signed certificate thus failing to connect.

Error contacting https://dev.my-website.com/umbraco/uSyncReceive/uSyncReceiveApi/Enabled : The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch, RemoteCertificateChainErrors
System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch, RemoteCertificateChainErrors

Version (please complete the following information):

• Umbraco Version: 13.11.0
• uSync Version 13.3.2
• uSync.Complete Version 13.2.2

To Reproduce
Steps to reproduce the behavior:

1. Configure secure keys on localhost instance and remote instance of umbraco (that uses selfsigned cert)
2. Click on Test connection in uSync Publisher
3. You will see Unreachable message and log warning "The remote certificate is invalid according to the validation procedure"

Expected behavior
Publisher code would respect HttpClientFactoryOptions set in startup when creating new HttpClient in GetHMACClient method.

[KevinJump]

Hi,

I am just looking into this, to see if there is anything we can / should be doing.

we are creating the HttpClient for Publisher during startup like this:

builder.Services
    .AddHttpClient(uSyncPublisher.ClientName)
    .AddHttpMessageHandler<HMACHandler>();

So i suspect what we need to do is somehow inherit basic settings from another config somewhere ?

Looking at some issues over on the dotnet repo.

• Enable HttpClient configuration inheritance with HttpClientFactory registration dotnet/extensions#1988
• [Feature request] Add a way to combine and reuse HttpClientFactory configurations dotnet/extensions#2038

I don't quite know what we should be doing ? I suspect we need to have something pluggable where you can add config to the client (because i can't see how we would inherit anything - especially if we don't actually know what's been set)

Do you in this example have some Client config in your code you think we should be inheriting ?

---

Local testing with the self signed dev cert is how we work all the time and that "just works" but i am guessing that this is different from that

[gregor-tusar]

Hm, if you say that you already work with self signed certs already, then I need to have a closer look into our setup again.