Remote certificate name mismatch error is ignored by default

.NET SDK
,
1

Using CouchbaseNetClient 3.6.4 nuget package in .NET 8.

When I’m connecting to CB using TLS, a remote certificate name mismatch error is ignored by default. However, if I assign the KvCertificateCallbackValidation delegate, the error is reported to it.

var options = new ClusterOptions
{
    ConnectionString = "...",
    EnableTls = true,
    KvIgnoreRemoteCertificateNameMismatch = false
    // etc.
};

clusterOptions.KvCertificateCallbackValidation += (sender, certificate, chain, errors) =>
{
    // if this delegate is assigned, it receives a call with errors = RemoteCertificateNameMismatch
}

var cluster = await Couchbase.Cluster.ConnectAsync(clusterOptions).ConfigureAwait(false);
await cluster.WaitUntilReadyAsync(TimeSpan.FromSeconds(15)).ConfigureAwait(false);

If I do the same with a nuget package earlier than 3.6.0, the name mismatch causes WaitUntilReadyAsync() to throw UnambiguousTimeoutException instead.

Is the client library swallowing the error on purpose?

I checked the release notes of 3.6.0 and can only see unrelated changes. There is a certificate-related change but it’s about client certificates, not server certificates.

2

The default callback will only ignore name mismatch when KvIgnoreRemoteCertificateNameMismatch is true. Can.you show your cluster options for certificate validation? This might be related to Jira

3

This is what my ClusterOptions looks like:

return new ClusterOptions
{
    KvTimeout = TimeSpan.FromMinutes(1),
    TcpKeepAliveTime = TimeSpan.FromMinutes(4),
    QueryTimeout = TimeSpan.FromMinutes(4),
    ConnectionString = "couchbase://...",
    EnableTls = true,
    EnableTcpKeepAlives = true,
    UserName = "...",
    Password = "...",
    Serializer = new DefaultSerializer(
        deserializationSettings: new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All },
        serializerSettings: new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All, ContractResolver = new DefaultContractResolver() }),
    X509CertificateFactory = new CertificateStoreFactory(new CertificateStoreSearchCriteria
            {
                FindValue = "",
                X509FindType = X509FindType.FindBySubjectName,
                StoreLocation = StoreLocation.LocalMachine,
                StoreName = StoreName.Root,
            }
};
1 Like