TLS certificate validation callback always accepts the certificate
ID |
vbnet.misconfiguration.insecure_ssl |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
high |
Remediation Effort |
medium |
Resource |
Misconfiguration |
Language |
VB.NET |
Description
The TLS certificate-validation callback unconditionally returns True, so every certificate is accepted regardless of validity. This disables certificate validation and exposes the connection to man-in-the-middle attacks. Inspect the SslPolicyErrors argument and reject the certificate when it is not SslPolicyErrors.None.
Rationale
The TLS certificate-validation callback unconditionally returns True, so every certificate is accepted regardless of validity. This disables certificate validation and exposes the connection to man-in-the-middle attacks. Inspect the SslPolicyErrors argument and reject the certificate when it is not SslPolicyErrors.None.
The following code illustrates a vulnerable pattern detected by this rule:
Public Sub TrustAllInline()
' VULNERABLE: TLS certificate validation callback always accepts the certificate
ServicePointManager.ServerCertificateValidationCallback = Function(sender, cert, chain, errors) True
End SubRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A04 : Cryptographic Failures.
-
OWASP Top 10 2025 - A07 : Authentication Failures.
-
https://learn.microsoft.com/en-us/dotnet/api/system.net.security.remotecertificatevalidationcallback