"Could not establish trust relationship for the SSL/TLS secure channel" with valid certificate

1
votes

I have a WCF service running on an Amazon cloud server. Sometimes on some clients - which are long-running processes which poll the service every 5 minutes - the following exception occurs:

System.ServiceModel.Security.SecurityNegotiationException: Could not establish trust relationship for the SSL/TLS secure channel with authority 'myservicehost.com'. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

This looks like there's a problem with the SSL certificate, but I cannot find out why. The certificate was issued by DigiCert.

The strange thing is that always at startup of the client, the WCF call succeeds. Then, as I wrote, every 5 minutes the call is repeated. This works fine until some time between 30 minutes and 8 hours has passed. From then on it doesn't work anymore and the above exception occurs on every subsequent call. This state can then remain for a couple of days.

In some rare cases, after 2/3 days, it works again for a short period, before the exceptions start coming again.

When I restart the client process, it's fine again for some time until the above issue starts over and over again.

There are plenty of messages here at SO with this title but I did not find any related to my special issue. In most other cases, the exception occurs always and not on an irregular basis. So can anyone help or try to point me in some direction?

1
.netwcfssl

1 Answers

0
votes

Finally after researching a long time, I found the solution. In the same process in our software another module was running at the same time which did FTP requests and which contained the following code:

ServicePointManager.ServerCertificateValidationCallback =
    new RemoteCertificateValidationCallback( myCertificateValidation );

myCertificateValidation was a callback method doing a custom validation. Unfortunately, in my case, it always returned false. This lead to the above exception. Because the FTP module didn't run all the time, the error was very hard to find.