GridLab Zero Trust Certificate Validation - Skills Guide¶

Skill Type: Security & Networking Technology Stack: .NET, SSL/TLS, Certificate Validation, Zero Trust Architecture Complexity Level: Intermediate Last Updated: 2024

📋 Overview¶

The Zero Trust module provides enterprise-grade SSL/TLS certificate validation services with configurable policy error handling, enabling secure remote connections while maintaining flexibility for development and testing environments.

Key Capabilities¶

✅ Configurable SSL policy error handling
✅ Certificate validation service abstraction
✅ Support for self-signed certificates (dev/test)
✅ Chain validation customization
✅ Name mismatch tolerance configuration
✅ Consistent validation across application

Zero Trust Principles¶

Never Trust, Always Verify: Validate every certificate
Least Privilege: Configure minimum required policy errors
Defense in Depth: Multiple layers of security validation

Prerequisites¶

.NET 9.0 or higher
Understanding of SSL/TLS concepts
NuGet package manager

🚀 Quick Start¶

Step 1: Install NuGet Package¶

Install the GridLab.Abp.ZeroTrust package from NuGet:

Install-Package GridLab.Abp.ZeroTrust

Package Information:

Package Name: GridLab.Abp.ZeroTrust
Repository: GitLab - GridLab ABP Framework
NuGet: GridLab.Abp.ZeroTrust

Step 2: Add Module Dependency¶

Add the AbpGridLabZeroTrustModule to your ABP module's dependency list:

[DependsOn(
    //...other dependencies
    typeof(AbpGridLabZeroTrustModule)
)]
public class YourModule : AbpModule
{
}

Step 3: Configure SSL Policy¶

Add SSL configuration to your appsettings.json:

{
  \"ZeroTrust\": {
    \"Ssl\": {
      \"AcceptablePolicyErrors\": [
        \"None\"
      ]
    }
  }
}

⚙️ Configuration Reference¶

SSL Policy Errors¶

The module supports configuring acceptable SSL policy errors based on your environment:

Policy Error	Description	When to Use
None	No errors accepted - strict validation	✅ Production (recommended)
RemoteCertificateNotAvailable	Accept when certificate is missing	⚠️ Development/Testing only
RemoteCertificateNameMismatch	Accept hostname mismatches	⚠️ Development/Testing only
RemoteCertificateChainErrors	Accept chain validation errors	⚠️ Self-signed certificates

Environment-Specific Configurations¶

Production Configuration (Strict)¶

{
  \"ZeroTrust\": {
    \"Ssl\": {
      \"AcceptablePolicyErrors\": [
        \"None\"
      ]
    }
  }
}

Development Configuration (Relaxed)¶

{
  \"ZeroTrust\": {
    \"Ssl\": {
      \"AcceptablePolicyErrors\": [
        \"None\",
        \"RemoteCertificateNameMismatch\",
        \"RemoteCertificateChainErrors\"
      ]
    }
  }
}

Programmatic Configuration¶

You can also configure SSL policy without appsettings.json:

public override void ConfigureServices(ServiceConfigurationContext context)
{
    var hostEnvironment = context.Services.GetHostingEnvironment();

    Configure<CertificateValidatorOptions>(options =>
    {
        if (hostEnvironment.IsDevelopment())
        {
            // Relaxed for development
            options.AcceptablePolicyErrors = new[]
            {
                SslPolicyErrors.None,
                SslPolicyErrors.RemoteCertificateNameMismatch,
                SslPolicyErrors.RemoteCertificateChainErrors
            };
        }
        else
        {
            // Strict for production
            options.AcceptablePolicyErrors = new[]
            {
                SslPolicyErrors.None
            };
        }
    });
}
````

### 💡 Usage Examples

#### Basic Certificate Validation

```csharp
public class SecureHttpService : ITransientDependency
{
    private readonly ICertificateValidator _certificateValidator;
    private readonly ILogger<SecureHttpService> _logger;

    public SecureHttpService(
        ICertificateValidator certificateValidator,
        ILogger<SecureHttpService> logger)
    {
        _certificateValidator = certificateValidator;
        _logger = logger;
    }

    public void ValidateConnection()
    {
        var sender = new object();
        var certificate = new X509Certificate();
        var chain = new X509Chain();
        var sslPolicyErrors = SslPolicyErrors.None;

        bool isValid = _certificateValidator.RemoteCertificateValidationCallback(
            sender,
            certificate,
            chain,
            sslPolicyErrors
        );

        if (isValid)
        {
            _logger.LogInformation("Certificate validation successful");
        }
        else
        {
            _logger.LogWarning("Certificate validation failed");
        }
    }
}

Redis Integration¶

public class RedisConnectionService
{
    private readonly ICertificateValidator _certificateValidator;
    private readonly IConfiguration _configuration;

    public RedisConnectionService(
        ICertificateValidator certificateValidator,
        IConfiguration configuration)
    {
        _certificateValidator = certificateValidator;
        _configuration = configuration;
    }

    public ConnectionMultiplexer CreateConnection()
    {
        var redisConfiguration = _configuration["Redis:Configuration"]!;
        var redisOptions = ConfigurationOptions.Parse(redisConfiguration);

        // Apply certificate validation
        redisOptions.CertificateValidation += (sender, certificate, chain, sslPolicyErrors) =>
        {
            return _certificateValidator.RemoteCertificateValidationCallback(
                sender,
                certificate,
                chain,
                sslPolicyErrors
            );
        };

        return ConnectionMultiplexer.Connect(redisOptions);
    }
}

HttpClient Integration¶

public class SecureApiClient
{
    private readonly ICertificateValidator _certificateValidator;

    public SecureApiClient(ICertificateValidator certificateValidator)
    {
        _certificateValidator = certificateValidator;
    }

    public HttpClient CreateHttpClient()
    {
        var handler = new HttpClientHandler();

        handler.ServerCertificateCustomValidationCallback = 
            (message, certificate, chain, sslPolicyErrors) =>
            {
                return _certificateValidator.RemoteCertificateValidationCallback(
                    message,
                    certificate,
                    chain,
                    sslPolicyErrors
                );
            };

        return new HttpClient(handler);
    }
}

Database Connection with SSL¶

public class SecureDatabaseConnection
{
    private readonly ICertificateValidator _certificateValidator;

    public SecureDatabaseConnection(ICertificateValidator certificateValidator)
    {
        _certificateValidator = certificateValidator;
    }

    public SqlConnection CreateConnection(string connectionString)
    {
        var connection = new SqlConnection(connectionString);

        // For SQL Server with custom certificate validation
        // Note: Actual implementation depends on database provider

        return connection;
    }
}

🔧 Advanced Scenarios¶

Custom Validation Logic¶

public class CustomCertificateValidator : ICertificateValidator
{
    private readonly ILogger<CustomCertificateValidator> _logger;
    private readonly CertificateValidatorOptions _options;

    public CustomCertificateValidator(
        IOptions<CertificateValidatorOptions> options,
        ILogger<CustomCertificateValidator> logger)
    {
        _options = options.Value;
        _logger = logger;
    }

    public bool RemoteCertificateValidationCallback(
        object sender,
        X509Certificate? certificate,
        X509Chain? chain,
        SslPolicyErrors sslPolicyErrors)
    {
        // Log all validation attempts
        _logger.LogDebug(
            "Certificate validation: Errors={Errors}, Subject={Subject}",
            sslPolicyErrors,
            certificate?.Subject
        );

        // Check if error is acceptable
        if (_options.AcceptablePolicyErrors.Contains(sslPolicyErrors))
        {
            return true;
        }

        // Custom validation logic
        if (certificate != null && IsInternalCertificate(certificate))
        {
            _logger.LogInformation("Accepting internal certificate");
            return true;
        }

        _logger.LogWarning(
            "Certificate validation failed: {Errors}",
            sslPolicyErrors
        );
        return false;
    }

    private bool IsInternalCertificate(X509Certificate certificate)
    {
        // Custom logic to identify internal certificates
        return certificate.Subject.Contains("CN=internal");
    }
}

📚 Best Practices¶

✅ Do's¶

Use strict validation (None only) in production
Configure environment-specific policies
Log all certificate validation failures
Regularly update trusted certificate authorities
Use proper certificate management (Azure Key Vault, etc.)
Test certificate validation in staging environments
Document why specific policy errors are accepted

❌ Don'ts¶

Don't accept all policy errors in production
Don't disable certificate validation entirely
Don't ignore certificate expiration
Don't use self-signed certificates in production
Don't hardcode certificate validation logic
Don't skip chain validation without good reason

🔍 Troubleshooting¶

Common Issues¶

Issue: Certificate validation always fails

Solution: Check if certificate is properly installed
Solution: Verify certificate hasn't expired
Solution: Ensure certificate chain is complete

Issue: Self-signed certificate rejected

Solution: Add RemoteCertificateChainErrors to acceptable errors (dev only)
Solution: Install self-signed certificate in trusted root store

Issue: Name mismatch errors

Solution: Ensure hostname matches certificate CN/SAN
Solution: Add RemoteCertificateNameMismatch for development
Solution: Use proper DNS name instead of IP address

⚠️ Security Considerations¶

Production Security Checklist¶

✅ Only accept SslPolicyErrors.None
✅ Use certificates from trusted Certificate Authorities
✅ Implement certificate pinning for critical connections
✅ Monitor certificate expiration dates
✅ Use TLS 1.2 or higher
✅ Implement proper error logging
✅ Regular security audits

Development vs Production¶

// ❌ BAD: Same policy for all environments
Configure<CertificateValidatorOptions>(options =>
{
    options.AcceptablePolicyErrors = new[]
    {
        SslPolicyErrors.RemoteCertificateChainErrors // Too permissive!
    };
});

// ✅ GOOD: Environment-specific policies
Configure<CertificateValidatorOptions>(options =>
{
    options.AcceptablePolicyErrors = hostEnvironment.IsProduction()
        ? new[] { SslPolicyErrors.None }
        : new[] { SslPolicyErrors.None, SslPolicyErrors.RemoteCertificateChainErrors };
});