Connecting to Third-Party Services: Handling SSL/TLS Certificate Validation in X++ and Ignoring Certificate Issues

In the world of software development, securely connecting to third-party services is a crucial aspect. However, there are times when you may encounter SSL/TLS certificate validation issues while connecting to these services. If you are working with X++ in Microsoft Dynamics 365 Finance and Operations (D365FO), you might have come across the "The remote certificate is invalid according to the validation procedure. The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel" error. There are a number of reasons why this error could be issued. For us, there was no valid certificate setup.

In this blog post, we will explore how to handle this certificate validation issue in X++, allowing you to connect to the third-party service successfully. 

Understanding the Certificate Validation Issue: 

When making web requests in X++ to a service secured with SSL/TLS, the underlying .NET framework performs certificate validation to ensure a secure connection. If the certificate of the remote service cannot be verified or does not meet the validation criteria, the above error is thrown, preventing the connection. 

Ignoring the Certificate Issue in .NET: 

In .NET, there is a simple method to ignore certificate validation errors using the `ServicePointManager.ServerCertificateValidationCallback delegate. This approach is not recommended for production scenarios, as it compromises the security of your application. However, it can be useful during development or testing when dealing with self-signed certificates or other temporary situations. 

ServicePointManager.ServerCertificateValidationCallback += (sender, cert, chain, sslPolicyErrors) => true; 

Translating the Solution to X++: 

In X++, achieving a similar result requires a bit more effort compared to .NET. Here's the code to bypass certificate validation in X++. There are two snippets - for the web request method and the delegate class.

Web request:

Delegate handler:

Explanation: 

In the above code, we access the `ServerCertificateValidationCallback` object for the current web request and set it to bypass SSL certificate validation by calling the `serverCertificateValidationCallBack` method in the ramax_CertificateDelegateHandler class which returns true. This will allow the X++ application to proceed with the connection despite any certificate validation errors. 

Please Note: 

1. Using this approach should be limited to non-production environments and temporary situations. In a production environment, always ensure that the certificate validation is enforced to maintain the highest level of security. We only used this approach while our client setup a valid certificate on their server while we were in development phase. This code was never applied to Tier 2 or above environments.
2. Ignoring certificate validation errors might expose your application to potential security risks, so use this method judiciously and only when absolutely necessary.

Handling SSL/TLS certificate validation issues is an essential part of secure web communication. While .NET provides a simple way to ignore certificate validation errors during development, X++ in D365FO requires a different approach. By using the provided code snippet, you can bypass certificate validation in X++ and establish connections to third-party services in specific scenarios. However, remember to revert to proper certificate validation before deploying your application to production to ensure data security and integrity. Remember, always prioritize security when connecting to external services, and use this workaround with caution and discretion. 

Happy coding!