title: ASP.NET Core Restful Web API Https - Client Connection Certificate Errors
body: <p>I built an ASP.NET Core 3.1 Web API that uses JWT for authentication; published the project and deployed to Windows 2019 server running IIS.</p>
  <p>In IIS I created the site as follows:</p>
  <ol>
  <li><p>created new Application Pool with 'No Managed Code' as the .NET CLR Version. Normally websites run inside an IIS worker process, but in .NET Core they run as a separate process, so there's no need for a .NET Runtime in the app pool.</p>
  </li>
  <li><p>created a new website for my ASP.NET Core application: selected the app pool previously created, set the Physical Path to the folder that contains the published app, selected HTTPS as the binding and also selected the certificate in the SSL certificate dropdown to the certificate I obtained from Comodo. I also set Hostname and checked 'Require server name indication' to true - because I have legacy WCF sites that have a different hostname but are on the same IP.</p>
  </li>
  </ol>
  <p>In Postman when I send a request with SSL Certificate Verification on, I get an <strong>SSL Error: Hostname/IP does not match certificate's altnames</strong>. With SSL Verification off it works without error.</p>
  <p>When creating a .NET desktop client using HttpClient and send a request to the site I get an error: <strong>The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.</strong></p>
  <p>When I Google this issue I find mostly articles related to people using self-signed certs on dev environments.</p>
  <p>If I add the following code to my client it works without issue:</p>
  <pre><code>if (http_client == null)
  {
      var handler = new HttpClientHandler()
      {
           AllowAutoRedirect = false,
           ServerCertificateCustomValidationCallback = (message, cert, chain, errors) =&gt; true,
           SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls11 | SslProtocols.Tls
      };
      http_client = new HttpClient(handler);
  }
  </code></pre>
  <p><strong>Why am I getting these SSL errors? Is my site not configured correctly?</strong> I want to provide access to the site to developers soon, but I'm concerned they will have problems connecting. Some will be connecting from iOS environment, others from different website server platforms.</p>
  <p><strong>Startup.cs</strong> for the Web API</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddCors();
      services.AddControllers().AddJsonOptions(x =&gt; x.JsonSerializerOptions.IgnoreNullValues = true);
  
      // configure strongly typed settings objects
      var appSettingsSection = Configuration.GetSection(&quot;AppSettings&quot;);
      services.Configure&lt;AppSettings&gt;(appSettingsSection);
  
      // configure jwt authentication
      var appSettings = appSettingsSection.Get&lt;AppSettings&gt;();
      var key = Encoding.ASCII.GetBytes(appSettings.Secret);
      services.AddAuthentication(x =&gt;
      {
          x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
          x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
      })
      .AddJwtBearer(x =&gt;
      {
          x.RequireHttpsMetadata = false;
          x.SaveToken = true;
          x.TokenValidationParameters = new TokenValidationParameters
          {
              ValidateIssuerSigningKey = true,
              IssuerSigningKey = new SymmetricSecurityKey(key),
              ValidateIssuer = false,
              ValidateAudience = false,
              // set clockskew to zero so tokens expire exactly at token expiration time (instead of 5 minutes later)
              ClockSkew = TimeSpan.Zero
          };
      });
  
      // configure DI for application services
      services.AddScoped&lt;IUserService, UserService&gt;();
  }
  
  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
  {
      app.UseRouting();
      app.UseHttpsRedirection();
      if (env.IsDevelopment())
      {
          app.UseDeveloperExceptionPage();
          gFunc.SetFolderPaths(true);
      }
      // global cors policy
      app.UseCors(x =&gt; x
         .SetIsOriginAllowed(origin =&gt; true)
         .AllowAnyMethod()
         .AllowAnyHeader()
         .AllowCredentials());
      app.UseAuthentication();
      app.UseAuthorization();
      app.UseEndpoints(x =&gt; x.MapControllers());
  }
  </code></pre>