We are currently experiencing an issue with our ITFoxtec implementation. It takes approx. 30 seconds for the code to authenticate the user. If we try this approach on localhost, the authentication is instant. The app is hosted on a on-premises server (not cloud) and this server has it's own firewall, proxy and other related infrastructure settings. We checked the logs and the problem is related to the process of building the certificate chain of the SSL server certificate with X509Chain.Build. This issue is similar to https://learn.microsoft.com/en-us/archive/blogs/alejacma/big-delay-when-calling-sslstream-authenticateasclient
Once we saw this error, we went to https://github.com/ITfoxtec/ITfoxtec.Identity.Saml2/blob/master/src/ITfoxtec.Identity.Saml2/Util/Saml2CertificateValidator.cs to better understand the code and try to come up with a solution. Based on this, we tried 3 different approaches but still no luck:
- X509CertificateValidationMode.ChainTrust (external check)
- X509CertificateValidationMode.PeerTrust (local check)
- X509CertificateValidationMode.None (no check at all)
From a logs perspective, this is the workflow: 000000dda5bec1c0 00007ffbdbeaf0fc Interop+crypt32.CertGetCertificateChain(Internal.Cryptography.Pal.Native.ChainEngine, Internal.Cryptography.Pal.Native.SafeCertContextHandle, Internal.Cryptography.Pal.Native.FILETIME*, Internal.Cryptography.Pal.Native.SafeCertStoreHandle, Internal.Cryptography.Pal.Native.CERT_CHAIN_PARA ByRef, Internal.Cryptography.Pal.Native.CertChainFlags, IntPtr, Microsoft.Win32.SafeHandles.SafeX509ChainHandle ByRef) 000000dda5bec220 00007ffbdbeae838 Internal.Cryptography.Pal.ChainPal.BuildChain(Boolean, Internal.Cryptography.ICertificatePal, System.Security.Cryptography.X509Certificates.X509Certificate2Collection, System.Security.Cryptography.OidCollection, System.Security.Cryptography.OidCollection, System.Security.Cryptography.X509Certificates.X509RevocationMode, System.Security.Cryptography.X509Certificates.X509RevocationFlag, System.DateTime, System.TimeSpan) 000000dda5bec360 00007ffbdbeae2cb System.Security.Cryptography.X509Certificates.X509Chain.Build(System.Security.Cryptography.X509Certificates.X509Certificate2, Boolean) 000000dda5bec480 00007ffbdbeadd05 System.Security.Cryptography.X509Certificates.X509Chain.Build(System.Security.Cryptography.X509Certificates.X509Certificate2) 000000dda5bec4b0 00007ffbdbead8c2 ITfoxtec.Identity.Saml2.Util.Saml2CertificateValidator.ValidateChainTrust(System.Security.Cryptography.X509Certificates.X509Certificate2) 000000dda5bec560 00007ffbdbead301 ITfoxtec.Identity.Saml2.Util.Saml2CertificateValidator.Validate(System.Security.Cryptography.X509Certificates.X509Certificate2)
Does anyone have any ideas how to bypass the certificate validation completely? We just want to authenticate the user as quick as possible without any additional checks.
Thank you!