ServerCertificateCustomValidationCallback not being called in MAUI Single Project

[wickedw]

Description

Not sure if this is a bug or some user error / local to my MAC.
But the key is that the Xamarin.iOS project included runs the same code and fires the ServerCertificateCustomValidationCallback correctly.

Would appreciate someone confirming this all works for them on similar setup, or if they know how to fix.

Below is a GitHub test MAUI project showing the issue using code generated using built in project templates + v basic httpclient call.

https://github.com/wickedw/MAUI.SSLTest

This brings up an SSL error on my Mac:
…
<6DEBE59F-950D-4187-9581-837B7767EDCF>.<1> finished with error [-1202] Error Domain=NSURLErrorDomain Code=-1202 "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “localhost” which could put your confidential information at risk." UserInfo={NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDomainKey=3, NSErrorPeerCertificateChainKey=(
"<cert(0x7f796c5d8400) s: localhost i: localhost>"
), NSErrorClientCertificateStateKey=0, NSErrorFailingURLKey=https://localhost:7161/WeatherForecast, NSErrorFailingURLStringKey=https://localhost:7161/WeatherForecast, NSUnderlyingError=0x6000039464f0 {Error Domain=kCFErrorDomainCFNetwork Code=-1202 "(null)" UserInfo={_kCFStreamPropertySSLClientCertificateState=0, kCFStreamPropertySSLPeerTrust=<SecTrustRef: 0x6000007d9c20>, _kCFNetworkCFStreamSSLErrorOriginalValue=-9813, _kCFStreamErrorDomainKey=3, _kCFStreamErrorCodeKey=-9813, kCFStreamPropertySSLPeerCertificates=(
"<cert(0x7f796c5d8400) s: localhost i: localhost>"
)}}, _NSURLErrorRelatedURLSessionTaskErrorKey=(
"LocalDataTask <6DEBE59F-950D-4187-9581-837B7767EDCF>.<1>"
), _kCFStreamErrorCodeKey=-9813, _NSURLErrorFailingURLSessionTaskErrorKey=LocalDataTask <6DEBE59F-950D-4187-9581-837B7767EDCF>.<1>, NSURLErrorFailingURLPeerTrustErrorKey=<SecTrustRef: 0x6000007d9c20>, NSLocalizedDescription=The certificate for this server is invalid. You might be connecting to a server that is pretending to be “localhost” which could put your confidential information at risk.}
...

You can see from code I am trying to trap the error and ignore it using

ServerCertificateCustomValidationCallback

I have added a Xamarin.iOS project which calls the same code which successfully traps the error and works fine.

Thanks for your help
Matt

Steps to Reproduce

1. Run iOS single MAUI project saltiest (and saltiest.api) and ServerCertificateCustomValidationCallback not reached and error shown.
   Click "Click Me" once the api has loaded up ready for the call.
2. Run seperate iOS project saltiest.ios (and API) and ServerCertificateCustomValidationCallback reached and no error shown.

There should be 2 multiple projects to start in the solution so you can boot up API and run App at same time.

dotnet version 6.0.301

Version with bug

Unknown/Other (please specify)

Last version that worked well

Unknown/Other

Affected platforms

iOS

Affected platform versions

tested on iOS 15.5

Did you find any workaround?

No response

Relevant log output

Visual Studio Community 2022 for Mac Preview
Version 17.3 Preview (17.3 build 1038)
Installation UUID: 5f439de2-c6ab-4cca-9e9a-518a5a30fe62

Runtime
.NET 6.0.5 (64-bit)
Architecture: X64

Roslyn (Language Service)
4.3.0-2.22307.14+b91fc5b06135deb5bd72c105a1b96ce278ad6beb

NuGet
Version: 6.0.0.262

.NET SDK (x64)
SDK: /usr/local/share/dotnet/sdk/6.0.301/Sdks
SDK Versions:
	6.0.301
	6.0.300
	6.0.202
	6.0.105
	6.0.104
	6.0.103
	6.0.102
	6.0.101
	6.0.100-rc.1.21463.6
	5.0.408
	5.0.407
	5.0.406
	5.0.405
	5.0.404
	5.0.403
	5.0.402
	5.0.401
	5.0.400
	5.0.302
	5.0.301
	5.0.203
	5.0.202
	5.0.201
	5.0.103
	5.0.102
	5.0.101
	5.0.100
	3.1.420
	3.1.419
	3.1.418
	3.1.417
	3.1.416
	3.1.415
	3.1.414
	3.1.413
	3.1.412
	3.1.411
	3.1.410
	3.1.409
	3.1.408
	3.1.407
	3.1.406
	3.1.405
	3.1.404
	3.1.403
	3.1.402
	3.0.103
	2.1.811
MSBuild SDKs: /Volumes/MacOST7/Applications/Visual Studio (Preview).app/Contents/MonoBundle/MSBuild/Current/bin/Sdks

.NET Runtime (x64)
Runtime: /usr/local/share/dotnet/dotnet
Runtime Versions:
	6.0.6
	6.0.5
	6.0.4
	6.0.3
	6.0.2
	6.0.1
	6.0.0-rc.1.21451.13
	5.0.17
	5.0.16
	5.0.15
	5.0.14
	5.0.13
	5.0.12
	5.0.11
	5.0.10
	5.0.9
	5.0.8
	5.0.7
	5.0.6
	5.0.5
	5.0.4
	5.0.3
	5.0.2
	5.0.1
	5.0.0
	3.1.26
	3.1.25
	3.1.24
	3.1.23
	3.1.22
	3.1.21
	3.1.20
	3.1.19
	3.1.18
	3.1.17
	3.1.16
	3.1.15
	3.1.14
	3.1.13
	3.1.12
	3.1.11
	3.1.10
	3.1.9
	3.1.8
	3.0.3
	2.1.23
	2.1.22

Xamarin.Profiler
Version: 1.8.0.19
Location: /Applications/Xamarin Profiler.app/Contents/MacOS/Xamarin Profiler

Updater
Version: 11

Apple Developer Tools
Xcode 13.4.1 (20504)
Build 13F100

Xamarin.Mac
Version: 8.10.0.5 (Visual Studio Community)
Hash: 96b3edb6d
Branch: d17-2
Build date: 2022-05-18 07:32:06-0400

Xamarin.iOS
Version: 15.10.0.5 (Visual Studio Community)
Hash: 96b3edb6d
Branch: d17-2
Build date: 2022-05-18 07:32:07-0400

Xamarin Designer
Version: 17.3.0.110
Hash: 01d90a6c4
Branch: remotes/origin/d17-3
Build date: 2022-06-17 20:21:53 UTC

Xamarin.Android
Version: 12.3.99.95 (Visual Studio Community)
Commit: xamarin-android/main/5432886
Android SDK: /Users/matthewwaring/Library/Developer/Xamarin/android-sdk-macosx
	Supported Android versions:
		6.0  (API level 23)
		12.0 (API level 31)
		8.1  (API level 27)
		11.0 (API level 30)
		10.0 (API level 29)
		9.0  (API level 28)
		7.0  (API level 24)

SDK Command-line Tools Version: 5.0
SDK Platform Tools Version: 31.0.3
SDK Build Tools Version: 30.0.3

Build Information: 
Mono: dffa5ab
Java.Interop: xamarin/java.interop/main@1f27ab55
SQLite: xamarin/sqlite/3.38.5@df4deab
Xamarin.Android Tools: xamarin/xamarin-android-tools/main@fc3c2ac

Microsoft Build of OpenJDK
Java SDK: /Library/Java/JavaVirtualMachines/microsoft-11.jdk
11.0.12
Android Designer EPL code available here:
https://github.com/xamarin/AndroidDesigner.EPL

Eclipse Temurin JDK
Java SDK: /Library/Java/JavaVirtualMachines/temurin-8.jdk
1.8.0.302
Android Designer EPL code available here:
https://github.com/xamarin/AndroidDesigner.EPL

Android SDK Manager
Version: 17.2.0.47
Hash: d6dd135
Branch: remotes/origin/dev/tondat/main-menues~3
Build date: 2022-06-17 20:21:57 UTC

Android Device Manager
Version: 0.0.0.1127
Hash: 4bb4d48
Branch: remotes/origin/dev/tondat/main-1536295~1
Build date: 2022-06-17 20:21:57 UTC

Build Information
Release ID: 1703001038
Git revision: ab015cef741e20e3cc212648659ecbd4ed089d5a
Build date: 2022-06-17 20:19:58+00
Build branch: release-17.3
Build lane: release-17.3

Operating System
Mac OS X 12.3.1
Darwin 21.4.0 Darwin Kernel Version 21.4.0
    Fri Mar 18 00:45:05 PDT 2022
    root:xnu-8020.101.4~15/RELEASE_X86_64 x86_64

[Eilon]

Hi @wickedw , we've recently published some tutorials and additional info on how to get this working:

• Tutorial: How to connect from Android emulator to local ASP.NET Core web app #8131
• Document how to work with a local ASP.NET Core backend during development docs-maui#600

Could you have a look through those and see if it helps solve the problem?

[wickedw]

Hi Eilon,

Thanks for your prompt reply and the useful links. I had already read these MS articles previously before posting this, so spent a while reviewing them to see if I had missed anything.

From -

https://docs.microsoft.com/en-gb/xamarin/cross-platform/deploy-test/connect-to-local-web-services#bypass-the-certificate-security-check

I did not see this comment -

// This method must be in a class in a platform project, even if
// the HttpClient object is constructed in a shared project.

Maybe article could put this in a warning box rather than a missable comment "if" its key to getting the handler to hook up correctly.

That being said, I then implemented -

public HttpClientHandler GetInsecureHandler()
{
    HttpClientHandler handler = new HttpClientHandler();
    handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) =>
    {
        if (cert.Issuer.Equals("CN=localhost"))
            return true;
        return errors == System.Net.Security.SslPolicyErrors.None;
    };
    return handler;
}

Cross platform using partial methods as described AND my breakpoint in ServerCertificateCustomValidationCallback still did NOT fire!??

Have you any ideas why this would be so, can clearly see in DEBUG the cross platform handler being called / created in the iOS platform folder and then used in my HttpClient instantiation.

Thanks
Matt