Fix issue with X509VerificationFlags.AllowUnknownCertificateAuthority behavior

[davidorbelian]

Fix this issue with this solution.

How to test:
Replace your certificate-authority-data from kubeconfig with data from another certificate and run.

• BEFORE:
  The program works despite the non-validity of the certificate because of validation does not fail.
• AFTER:
  System.Net.Http.HttpRequestException is thrown because of validation fails.

[bartonjs]

If you want to test for a custom root you'd leave the check as it was, and then add isValid = isValid && rootCert.RawData.SequenceEqual(caCert.RawData);

As it is, this change would start accepting expired and revoked certificates (and possibly certificates where the signatures didn't check out).

[davidorbelian]

Thank you!

[davidorbelian]

@bartonjs can you please confirm now it is ok?

[bartonjs]

Seems right to me.

[bartonjs]

(Assuming that caCert is the root, and not just an intermediate. Otherwise you need to loop over the rest of the things to see if it was an intermediate)

[davidorbelian]

@bartonjs Sure, thank you!
@brendandburns What you think?

[brendandburns]

LGTM, thanks. Can you add a unit test that validates this behavior? e.g. fails w/o the fix, passes with the fix?

Thanks!

[davidorbelian]

@brendandburns Done!

[brendandburns]

LGTM, many thanks!