Okay, here is what I need to do:

My application, written in C# (.NET Framework 4.5), needs to communicate with our server via HTTPS. Our server uses a TLS/SSL certificate issued by our own Root-CA. That Root-CA, while perfectly trusted by my application, is **not** installed in the system's "trusted root" certificate store. So, without further work, C# refuses to contact the server, because the server's certificate cannot be validated - as expected. Note: We cannot use a Root-CA already installed in the system.

What can I do to allow my application to (securely) contact our server? I know that C# provides classes to install our Root-CA certificate into the *system's* certificate store as a "trusted root". That's **not** what we want to do! That's because **(a)** it shows an alarming (and way too technical) warning to the user, and because **(b)** it would effect other applications too - which we don't want or need.

So what I need is something that tells C#/.NET to use a "custom" (i.e. *application-specific*) set of certificates - instead of the system-wide certificate store - to validate the chain of the server certificate. The whole certificate chain still needs to be validated properly (including revocation lists!). Only our Root-CA needs to be accepted as a "trusted" root for **my** application.

What would be the best way to do this?

Any help would be much appreciated. Thanks in advance!

---

BTW: I found out that I can use `ServicePointManager.ServerCertificateValidationCallback` to install my own certificate validation function. This *does* work. But that method isn't good, because now I need to do the **whole** certificate validation *manually* in my own code. However, I do **not** want to re-implement the whole certificate verification process (e.g. downloading and checking CRL's etc), which is already implemented (and tested) in .NET Framework. It's like re-inventing the wheel and can never be tested as thoroughly as the .NET implementation that already exists.