title: "The remote certificate is invalid according to the validation procedure"
body: <p>This has been asked before but I am completely stuck and nothing so far has worked for me that has been listed in other questions. While this refers to Identity Server I think i have missed something in setting SSL up.</p>
  
  <p>I have setup as follows (this is with IIS express not full IIS):</p>
  
  <ul>
  <li>Identity Server app: auth.testhost.com:44373/core</li>
  <li>Web API service: <a href="https://localhost:44356/" rel="nofollow">https://localhost:44356/</a> </li>
  </ul>
  
  <p>I get the error in the title on the line:    </p>
  
  <pre><code>app.UseIdentityServerBearerTokenAuthentication(options);
  </code></pre>
  
  <p>This is basically requesting some open configuration options from the server at auth.testhost.com:44373/core/.well-known/openid-configuration.</p>
  
  <p>My options are:</p>
  
  <pre><code>Authority = "https://auth.testhost.com:44373/core",
  RequiredScopes = new List&lt;string&gt;() { "api" }
  </code></pre>
  
  <p>In some examples I see a client id and secret, but they are not available in the options for me: is this a problem?</p>
  
  <p>If you need to see any identity server options please say and I'll post. 
  I ran the following command to create a cert:</p>
  
  <pre><code>makecert.exe -r -pe -n "CN=auth.testhost.com" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 -len 2048
  </code></pre>
  
  <p>This generated the certificate, which I then exported to Trusted Root Certification Authorities. </p>
  
  <p>From what I can tell, the SSL port bindings should be handled by Visual Studio as I am using IIS Express. Below are the bindings it has:</p>
  
  <pre><code>&lt;site name="Authenticator_V2" id="2"&gt;
                  &lt;application path="/" applicationPool="Clr4IntegratedAppPool"&gt;
                      &lt;virtualDirectory path="/" physicalPath="c:\users\user\documents\visual studio 2015\Projects\Authenticator_V2\Authenticator_V2" /&gt;
                  &lt;/application&gt;
                  &lt;bindings&gt;
                      &lt;binding protocol="http" bindingInformation="*:49755:localhost" /&gt;
                      &lt;binding protocol="https" bindingInformation="*:44373:localhost" /&gt;
                      &lt;binding protocol="https" bindingInformation="*:44373:auth.testhost.com" /&gt;
                  &lt;/bindings&gt;
              &lt;/site&gt;
  &lt;site name="APIClient2" id="7"&gt;
                  &lt;application path="/" applicationPool="Clr4IntegratedAppPool"&gt;
                      &lt;virtualDirectory path="/" physicalPath="C:\Users\user\documents\visual studio 2015\Projects\Authenticator_V2\APIClient2" /&gt;
                  &lt;/application&gt;
                  &lt;bindings&gt;
                      &lt;binding protocol="http" bindingInformation="*:53812:localhost" /&gt;
                      &lt;binding protocol="https" bindingInformation="*:44356:localhost" /&gt;
                  &lt;/bindings&gt;
              &lt;/site&gt;
  </code></pre>
  
  <p>This is my hosts file:</p>
  
  <pre><code>127.0.0.1               localhost
  127.0.0.1               hybrid.testhost.com
  127.0.0.1               auth.testhost.com
  </code></pre>
  
  <p>When I go to <a href="https://auth.testhost.com:44373/" rel="nofollow">https://auth.testhost.com:44373/</a> I still have a red line through my protocol. I assume this means something has not been configured correctly still. I am using Chrome and clicking on the certificate gives:</p>
  
  <pre><code>"Your connection to this site is not private." 
  </code></pre>
  
  <p>Details:</p>
  
  <pre><code>SHA-1 Certificate
  The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1.
  
  View certificate
  
  Certificate Error
  There are issues with the site's certificate chain (net::ERR_CERT_COMMON_NAME_INVALID).
  </code></pre>
  
  <p>I looked at the ERR_CERT_COMMON_NAME_INVALID error and it seems that is a chrome bug. However my error is being thrown from the web services server trying to connect to the authentication server so I think I can ignore this one???</p>
  
  <p>I also ran netsh to check there was a cert binding set up:</p>
  
  <pre><code>netsh http show sslcert ipport=0.0.0.0:44373
  
  SSL Certificate bindings:
  -------------------------
  
      IP:port                      : 0.0.0.0:44373
      Certificate Hash             : HAS ODD HASH - REMOVED
      Application ID               : {HAS GUID - REMOVED}
      Certificate Store Name       : MY
      Verify Client Certificate Revocation : Enabled
      Verify Revocation Using Cached Client Certificate Only : Disabled
      Usage Check                  : Enabled
      Revocation Freshness Time    : 0
      URL Retrieval Timeout        : 0
      Ctl Identifier               : (null)
      Ctl Store Name               : (null)
      DS Mapper Usage              : Disabled
      Negotiate Client Certificate : Disabled
      Reject Connections           : Disabled
  </code></pre>
  
  <p>At this point a noticed this hash is not the right one for my certificate. It is for the IIS Express localhost. I found this link: <a href="https://stackoverflow.com/questions/28032215/identityserver-the-remote-certificate-is-invalid-according-to-the-validation-pr">IdentityServer: The remote certificate is invalid according to the validation procedure</a> and copied the steps to move the localhost certificate into the Trusted Root Certification Authorities but unfortunately I still have the error. I now am not sure what else to do.</p>
  
  <p>Scope Configuration:</p>
  
  <pre><code>new Scope
  {
      Name = "api",
      DisplayName = "Can call API",
      Enabled = true,
      Type = ScopeType.Resource
      //ScopeSecrets = new List&lt;Secret&gt; {  }
  }
  </code></pre>
  
  <p>All my clients have this scope.</p>
  
  <p>Thanks</p>