title: C# / .NET - How to allow a "custom" Root-CA for HTTPS in my application (only)?
body: <p>Okay, here is what I need to do:</p>
  
  <p>My application, written in C# (.NET Framework 4.5), needs to communicate with our server via HTTPS. Our server uses a TLS/SSL certificate issued by our own Root-CA. That Root-CA, while perfectly trusted by my application, is <strong>not</strong> installed in the system's "trusted root" certificate store. So, without further work, C# refuses to contact the server, because the server's certificate cannot be validated - as expected. Note: We cannot use a Root-CA already installed in the system.</p>
  
  <p>What can I do to allow my application to (securely) contact our server? I know that C# provides classes to install our Root-CA certificate into the <em>system's</em> certificate store as a "trusted root". That's <strong>not</strong> what we want to do! That's because <strong>(a)</strong> it shows an alarming (and way too technical) warning to the user, and because <strong>(b)</strong> it would effect other applications too - which we don't want or need.</p>
  
  <p>So what I need is something that tells C#/.NET to use a "custom" (i.e. <em>application-specific</em>) set of certificates - instead of the system-wide certificate store - to validate the chain of the server certificate. The whole certificate chain still needs to be validated properly (including revocation lists!). Only our Root-CA needs to be accepted as a "trusted" root  for <strong>my</strong> application.</p>
  
  <p>What would be the best way to do this?</p>
  
  <p>Any help would be much appreciated. Thanks in advance!</p>
  
  <hr>
  
  <p>BTW: I found out that I can use <code>ServicePointManager.ServerCertificateValidationCallback</code> to install my own certificate validation function. This <em>does</em> work. But that method isn't good, because now I need to do the <strong>whole</strong> certificate validation <em>manually</em> in my own code. However, I do <strong>not</strong> want to re-implement the whole certificate verification process (e.g. downloading and checking CRL's etc), which is already implemented (and tested) in .NET Framework. It's like re-inventing the wheel and can never be tested as thoroughly as the .NET implementation that already exists.</p>