Wayback Machinekoobas.hobune.stream
May JUN Jul
Previous capture 13 Next capture
2021 2022 2023
1 capture
13 Jun 22 - 13 Jun 22
sparklines
Close Help
  • Products
  • Solutions
  • Made with Unity
  • Learning
  • Support & Services
  • Community
  • Asset Store
  • Get Unity

UNITY ACCOUNT

You need a Unity Account to shop in the Online and Asset Stores, participate in the Unity Community and manage your license portfolio. Login Create account
  • Blog
  • Forums
  • Answers
  • Evangelists
  • User Groups
  • Beta Program
  • Advisory Panel

Navigation

  • Home
  • Products
  • Solutions
  • Made with Unity
  • Learning
  • Support & Services
  • Community
    • Blog
    • Forums
    • Answers
    • Evangelists
    • User Groups
    • Beta Program
    • Advisory Panel

Unity account

You need a Unity Account to shop in the Online and Asset Stores, participate in the Unity Community and manage your license portfolio. Login Create account

Language

  • Chinese
  • Spanish
  • Japanese
  • Korean
  • Portuguese
  • Ask a question
  • Spaces
    • Default
    • Help Room
    • META
    • Moderators
    • Topics
    • Questions
    • Users
    • Badges
  • Home /
avatar image
2
Question by sorran · May 30, 2013 at 06:55 PM · socketcertificatessl

SSL over socket Remote Certificate Not Available

I'm trying to setup a socket using SSL on .net, all works great except that we have to skip the validation of the certificate... I'm suspecting mono does not ship with any root certificates and unity is probably not using the platforms certificates

http://www.mono-project.com/UsingTrustedRootsRespectfully

Has anyone found a means to validate the certificates without simply accepting the certificate failure to prevent a man in the middle style attack. The mono guides I've looked at indicate installing certificates but given I am targetting for iOS and Android I'm not sure how / if this is possible at the mono level and if it would require going down to make an ios / android call to validate the cert? I would have hoped that the unity platform would delegate to the appropriate platform keystore for cert validation?

here's how we skip the validation callback:

 var secureStream = new SslStream(
       tcpclient.GetStream(),
       false,
       ValidateServerCertificate,
       null
       );

 public static bool ValidateServerCertificate(
       object sender,
       X509Certificate certificate,
       X509Chain chain,
       SslPolicyErrors sslPolicyErrors)
 {
     if (sslPolicyErrors != SslPolicyErrors.None)
     {
         Logger.WarnCh("comms", "Warn cert errors");
     }
     return true;
 }
Comment
Add comment · Show 2
10 |3000 characters needed characters left characters exceeded
▼
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Viewable by all users
avatar image sebas77 · Jun 20, 2013 at 03:10 PM 0
Share

I need the same answer! Do you think the WWW class also accept the certificate failure on desktop stand alone clients?

avatar image iamarugin · Jul 14, 2016 at 12:44 PM 0
Share

Do you find any solution?

1 Reply

· Add your reply
  • Sort: 
avatar image
0

Answer by sorran · Jun 20, 2013 at 03:23 PM

Not sure to be honest, I think the standard WWW unity API for https style stuff should be ok - my understanding is that this some sort of delegate down to the OS rather than relying on mono socket security frameworks.

I could be wrong and the WWW implementation maybe completely open to man in the middle, and reading some of the security related discussions on this forum it wouldn't surprise me if it was vulnerable.

Comment
Add comment · Show 1 · Share
10 |3000 characters needed characters left characters exceeded
▼
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Viewable by all users
avatar image sebas77 · Jun 20, 2013 at 03:25 PM 0
Share

O$$anonymous$$G this would be really bad...should I switch to uniweb?

Your answer

Hint: You can notify a user about this post by typing @username

Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

Follow this Question

Answers Answers and Comments

15 People are following this question.

avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image

Related Questions

Self signed SSL certificates for WWW class? 1 Answer

SSL signed by CA validation 0 Answers

Tell UnityWebRequest to trust invalid SSL certs 1 Answer

Is it possible to do ssl certificate pinning in Unity iOS 1 Answer

How can I add a certificate to the Mono Trust store? 1 Answer


Enterprise
Social Q&A

Social
Subscribe on YouTube social-youtube Follow on LinkedIn social-linkedin Follow on Twitter social-twitter Follow on Facebook social-facebook Follow on Instagram social-instagram

Footer

  • Purchase
    • Products
    • Subscription
    • Asset Store
    • Unity Gear
    • Resellers
  • Education
    • Students
    • Educators
    • Certification
    • Learn
    • Center of Excellence
  • Download
    • Unity
    • Beta Program
  • Unity Labs
    • Labs
    • Publications
  • Resources
    • Learn platform
    • Community
    • Documentation
    • Unity QA
    • FAQ
    • Services Status
    • Connect
  • About Unity
    • About Us
    • Blog
    • Events
    • Careers
    • Contact
    • Press
    • Partners
    • Affiliates
    • Security
Copyright © 2020 Unity Technologies
  • Legal
  • Privacy Policy
  • Cookies
  • Do Not Sell My Personal Information
  • Cookies Settings
"Unity", Unity logos, and other Unity trademarks are trademarks or registered trademarks of Unity Technologies or its affiliates in the U.S. and elsewhere (more info here). Other names or brands are trademarks of their respective owners.
  • Anonymous
  • Sign in
  • Create
  • Ask a question
  • Spaces
  • Default
  • Help Room
  • META
  • Moderators
  • Explore
  • Topics
  • Questions
  • Users
  • Badges