title: Error connecting to https://localhost:5002/.well-known/openid-configuration
body: <p>I am using Identity Server 4 and ASP.NET Core 2.1.</p>
  
  <p>I have an API and an Auth application and tried to following:</p>
  
  <pre><code>var discoveryClient = new DiscoveryClient("https://localhost:5002");
  
  discoveryClient.Policy.RequireHttps = true;
  
  var discovery = await discoveryClient.GetAsync();
  
  if (discovery.IsError) 
    Console.WriteLine(discovery.Error);
  </code></pre>
  
  <p>But I got the following error:</p>
  
  <pre><code>Error connecting to https://localhost:5002/.well-known/openid-configuration: 
  The SSL connection could not be established
  The remote certificate is invalid according to the validation procedure.
  </code></pre>
  
  <p>However if I access the url "<a href="https://localhost:5002/.well-known/openid-configuration" rel="nofollow noreferrer">https://localhost:5002/.well-known/openid-configuration</a>" in the browser I get the correct information and not errors.</p>
  
  <p><strong>What am I doing wrong?</strong>    </p>
  
  <p>The API application has the following configuration:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services) {
  
    services
      .AddMvc()
      .SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
  
    services.AddRouting(x =&gt; { x.LowercaseUrls = true; });        
  
    services.AddHsts(x =&gt; {
      x.Preload = true;
      x.IncludeSubDomains = true;
      x.MaxAge = TimeSpan.FromDays(60);
    });
  
    services.AddHttpsRedirection(x =&gt; {
      x.RedirectStatusCode = StatusCodes.Status301MovedPermanently;
      x.HttpsPort = 5001;
    });        
  
    services.AddApiVersioning(x =&gt; {
      x.ApiVersionSelector = new CurrentImplementationApiVersionSelector(x);
      x.AssumeDefaultVersionWhenUnspecified = true;
      x.DefaultApiVersion = new ApiVersion(1, 0);
      x.ReportApiVersions = false;                 
    });      
  
    services.AddCors(x =&gt; {
      x.AddPolicy("AllowAll", y =&gt; y.AllowAnyMethod().AllowAnyOrigin().AllowAnyHeader());
    });
  
    services.AddAuthorization();
  
    services
      .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
      .AddIdentityServerAuthentication(x =&gt; {
        x.ApiName = "api";
        x.Authority = "https://localhost:5002";
        x.RequireHttpsMetadata = false;
      });   
  
  } // ConfigureServices
  
  public void Configure(IApplicationBuilder application, IHostingEnvironment environment) {
  
    if (environment.IsDevelopment()) {        
      application.UseDeveloperExceptionPage();
    } else {
      application.UseHsts();         
    }      
  
    application.UseAuthentication();
    application.UseHttpsRedirection();      
    application.UseMvc();       
  
  } // Configure
  </code></pre>
  
  <p>And the Auth application with the following configuration:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services) {
  
    services
      .AddMvc()
      .SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
  
    services.AddRouting(x =&gt; { x.LowercaseUrls = true; });        
  
    services.AddHsts(x =&gt; {
      x.Preload = true;
      x.IncludeSubDomains = true;
      x.MaxAge = TimeSpan.FromDays(60);
    });
  
    services.AddHttpsRedirection(x =&gt; {
      x.RedirectStatusCode = StatusCodes.Status301MovedPermanently;
      x.HttpsPort = 5002;
    });        
  
    services
      .AddIdentityServer()
      .AddDeveloperSigningCredential()
      .AddInMemoryIdentityResources(Config.GetIdentityResources())
      .AddInMemoryApiResources(Config.GetApiResources())
      .AddInMemoryClients(Config.GetClients())
      .AddTestUsers(Config.GetTestUsers());
  
  } // ConfigureServices
  
  public void Configure(IApplicationBuilder application, IHostingEnvironment environment) {
  
    if (environment.IsDevelopment()) {        
      application.UseDeveloperExceptionPage();
    } else {
      application.UseHsts();        
    }      
  
    application.UseHttpsRedirection();
  
    application.UseIdentityServer();
  
    application.UseMvc();
  
  } // Configure
  </code></pre>
  
  <p>Where Config that defines Clients, Resources and Test Users is:</p>
  
  <pre><code>public class Config {
  
    public static List&lt;ApiResource&gt; GetApiResources() {
      return new List&lt;ApiResource&gt; { 
        new ApiResource("api", "API Resource")
      };
    }
  
    public static List&lt;IdentityResource&gt; GetIdentityResources() {
      return new List&lt;IdentityResource&gt; { 
        new IdentityResources.OpenId(),
        new IdentityResources.Profile()        
      };
    }
  
    public static List&lt;Client&gt; GetClients() {
  
      return new List&lt;Client&gt; { 
  
        new Client {                  
          ClientId = "app",
          ClientName = "APP Client",        
          ClientSecrets = { new Secret("app".Sha256()) },
          AllowedGrantTypes = GrantTypes.ClientCredentials,                
          AllowedScopes = { "api" }
        },
  
        new Client {
          ClientId = "mvc",
          ClientName = "MVC Client",
          ClientSecrets = { new Secret("mvc".Sha256()) },
          Enabled = true,
          AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
          AllowOfflineAccess = true,
          RequireConsent = false,
          RedirectUris = { "http://localhost:5002/signin-oidc" },
          PostLogoutRedirectUris = { "http://localhost:5002" },
          FrontChannelLogoutUri =  "http://localhost:5002/signout-oidc",
          AllowedScopes = {
            IdentityServerConstants.StandardScopes.OpenId,
            IdentityServerConstants.StandardScopes.Profile,
            IdentityServerConstants.StandardScopes.Email,
            "api"
          }
        },
  
        new Client {
          ClientId = "spa",
          ClientName = "SPA Client",
          ClientSecrets = { new Secret("spa".Sha256()) },          
          Enabled = true,
          AllowedGrantTypes = GrantTypes.Implicit,
          AllowAccessTokensViaBrowser = true,        
          RequireConsent = false,
          AllowedScopes = { 
            IdentityServerConstants.StandardScopes.OpenId,
            IdentityServerConstants.StandardScopes.Profile, 
            IdentityServerConstants.StandardScopes.Email,
            "api" 
          },
          RedirectUris = { "https://localhost:5000" },
          PostLogoutRedirectUris = { "https://localhost:5000/home" },
          AllowedCorsOrigins = { "https://localhost:5000" }
        }
      };
    }
  
    public static List&lt;TestUser&gt; GetTestUsers() {
      return new List&lt;TestUser&gt; { 
        new TestUser { SubjectId = "1", Username = "john", Password = "john", Claims = new List&lt;Claim&gt; { new Claim("name", "John") } },
      };
    }
  
  } // Config
  </code></pre>