<p>I want to make a call to Kubernetes API from .NET Core app outside the cluster. </p>

<p>I have an HttpClient with an HttpClientHandler where I set this callback to ignore invalid (untrusted) certificates and it works:</p>

<pre><code>handler.ServerCertificateCustomValidationCallback +=
    (message, certificate, chain, errors) =&gt; true;
</code></pre>

<p>But in my kubeconfig from kubectl I have this:</p>

<pre><code>...
clusters:
- cluster:
    certificate-authority-data: SOME_AUTHORITY_DATA
    server: https://myserver.io:443
...
</code></pre>

<p>How can I validate server certificate using that <strong>certificate-authority-data</strong> in my application?</p>

David Orbelian
<pre><code>private static byte[] s_issuingCABytes = { ... };

handler.ServerCertificateCustomValidationCallback +=
    (message, certificate, chain, errors) =&gt;
    {
        const SslPolicyErrors Mask =
#if CA_IS_TRUSTED
            ~SslPolicyErrors.None;
#else
            ~SslPolicyErrors.RemoteCertificateChainErrors;
#endif

        // If a cert is not present, or it didn't match the host.
        // (And if the CA should have been root trusted anyways, also checks that)
        if ((errors &amp; Mask) != SslPolicyErrors.None)
        {
            return false;
        }

        foreach (X509ChainElement element in chain.ChainElements)
        {
            if (element.Certificate.RawData.SequenceEqual(s_issuingCABytes))
            {
                // The expected certificate was found, huzzah!
                return true;
            }
        }

        // The expected cert was not in the chain.
        return false;
    };
</code></pre>
