Is it possible to teach the keepalive agent to overcome TLS/SSL certificate warnings?

Question

We have an internal environment where the TLS/SSL certificate on tenants is not playing well with some requests. This is not a huge issue for clients who can add a one time trust for the certificate, but it causes some issues with the keepalive.aspx agent trying to poll the tenants root URL.

So my question is if anybody knows of a way to configure the keepalive agent in a way, that it can try to overcome certificate warnings / validations?

Here's an excerpt from our log file:

Exception in UrlAgent (url: /sitecore/service/keepalive.aspx)
Exception: System.Net.WebException
Message: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.
Source: System
   at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest& request)
   at System.Net.WebClient.DownloadData(Uri address)
   at Sitecore.Web.WebUtil.ExecuteWebPage(String url, NameValueCollection headers)
   at Sitecore.Tasks.UrlAgent.Run()

Nested Exception

Exception: System.Security.Authentication.AuthenticationException
Message: The remote certificate is invalid according to the validation procedure.

And yes, I do know that the proper way would be to fix the certificate :) I am actually more interested in a quick fix as due the affected environment is basically end of life and the next step would be a general overhaul anyway.

Answer 1

You can override UrlAgent that is used to make keepalive.aspx call. And disable certificate validation:

System.Net.ServicePointManager.ServerCertificateValidationCallback =
              ((sender, certificate, chain, sslPolicyErrors) => true);

It is configured in Sitecore.config:

<agent type="YourNamespace.YourUrlAgent" method="Run" interval="00:15:00">
  <param desc="url">/sitecore/service/keepalive.aspx</param>
  <LogActivity>true</LogActivity>
</agent>

You can have your own one class, where SSL errors are ignored

public class YourUrlAgent
{
    private readonly string _url;

    private bool _logActivity = true;

    /// <summary>
    /// Gets or sets a value indicating whether the <see cref="T:Sitecore.Tasks.UrlAgent" /> logs the activity.
    /// </summary>
    /// <value>
    ///     <c>true</c> if the <see cref="T:Sitecore.Tasks.UrlAgent" /> logs the  activity; otherwise, <c>false</c>.
    /// </value>
    public bool LogActivity
    {
        get
        {
            return this._logActivity;
        }
        set
        {
            this._logActivity = value;
        }
    }

    /// <summary>
    /// Initializes a new instance of the <see cref="T:Sitecore.Tasks.UrlAgent" /> class.
    /// </summary>
    /// <param name="url">The URL.</param>
    public UrlAgent(string url)
    {
        Assert.ArgumentNotNull(url, "url");
        this._url = url;
    }

    /// <summary>
    /// Runs the pipeline.
    /// </summary>
    public void Run()
    {
        try
        {
            //Trust all certificates 
            System.Net.ServicePointManager.ServerCertificateValidationCallback =
              ((sender, certificate, chain, sslPolicyErrors) => true);
            string fullUrl = WebUtil.GetFullUrl(this._url);
            this.LogInfo("Scheduling.UrlAgent started. Url: " + fullUrl);
            string text = WebUtil.ExecuteWebPage(fullUrl);
            this.LogInfo("Scheduling.UrlAgent done (received: " + text.Length + " bytes)");
        }
        catch (Exception exception)
        {
            Log.Error("Exception in UrlAgent (url: " + this._url + ")", exception, this);
        }
    }

    /// <summary>
    /// Logs the info.
    /// </summary>
    /// <param name="message">The message.</param>
    private void LogInfo(string message)
    {
        if (!this.LogActivity)
        {
            return;
        }
        Log.Info(message, this);
    }
}

P.S. As your wrote, it is not cool to do it.

P.S.2: If you have calls from your website to other URLs except keepalive.aspx, e.g. some API then it is much more better and secure to skip server certification check only for one request.