Zennoxa Shield
Rules / C#
SHIELD-CSHARP-019

Trust-all TLS certificate validation

highC#CWE-295CVSS 8.1

What it detects

A certificate validation callback is overridden to always return true, disabling TLS trust checks.

How to fix

Perform proper certificate chain and hostname validation instead of returning true unconditionally.

Vulnerable — Shield flags thisApiClientFactory.cs
using System.Net;

public static class ApiClientFactory
{
    public static void DisableTlsChecks()
    {
        // Accepts ANY certificate, including forged ones
        ServicePointManager.ServerCertificateValidationCallback = (sender, cert, chain, errors) => true;
    }
}
Fixed — scans cleanApiClientFactory.cs
using System.Net.Http;
using System.Net.Security;

public static class ApiClientFactory
{
    public static HttpClient Create()
    {
        var handler = new HttpClientHandler();
        handler.ServerCertificateCustomValidationCallback =
            (message, cert, chain, errors) => errors == SslPolicyErrors.None;
        return new HttpClient(handler);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-019, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-019: Trust-all TLS certificate validation — Zennoxa Shield