title: Best practices for using ServerCertificateValidationCallback
body: <p>I am working on a project that uses some HTTP communication between two back-end servers. Servers are using X509 certificates for authentication. Needless to say, when server A (client) establishes connection to server B (server), there is a SSL/TLS validation error, since certificates used are not from trusted 3rd party authority.</p>
  
  <p>Normally, the way to handle it is using <code>ServicePointManager.ServerCertificateValidationCallback</code>, such as:</p>
  
  <pre><code>ServicePointManager.ServerCertificateValidationCallback += 
          (sender, cert, chain, error) =&gt;
  {
      return cert.GetCertHashString() == "xxxxxxxxxxxxxxxx";
  };
  </code></pre>
  
  <p>That approach works, except it's not ideal. What it essentially does is override validation procedure for EVERY http request done by the application. So, if another class will try to run HTTP request, it will fail. Also, if another class overrides <code>ServicePointManager.ServerCertificateValidationCallback</code> for its own purposes, then my communication starts failing out of sudden.</p>
  
  <p>The only solution which comes to mind, is creating a separate <a href="http://msdn.microsoft.com/en-us/library/system.appdomain%28v=vs.110%29.aspx">AppDomain</a> to perform client HTTP requests. That would work, but really - it's silly to have to do that only so that one can perform HTTP requests. Overhead will be staggering.</p>
  
  <p>With that in mind, have anyone researched if there is a better practice in .NET, which would allow accessing web services, while handling client SSL/TLS validation without affecting other web clients?</p>