How to Solve The Remote Certificate is Invalid Because of Errors in the Certificate Chain Error in C sharp

If you are working with web APIs or web services in C#, you may encounter the following error when trying to establish an SSL connection:

AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: PartialChain

1	AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: PartialChain

This error means that the SSL certificate presented by the server is not trusted by your client, either because it is self-signed, expired, or does not match the host name you are using to connect.

In this blog post, we will show you how to solve this error by following these steps:

Check the server certificate and its chain.
Install or update the root and intermediate certificates on your client machine.
Use the correct host name or override the certificate validation.

Check the server certificate and its chain

The first step is to check the server certificate and its chain to see if they are valid and complete. You can do this by using one of these tools:

Chrome: Open the website in Chrome and click on the lock icon next to the address bar. Click on Certificate (invalid) and then on Certification Path. You should see the server certificate and its chain of trust. Look for any errors or warnings, such as Not Valid Time, Untrusted Root, or Name Mismatch.
OpenSSL: Run the following command in a terminal:

openssl s_client -connect host:port -servername host

1	openssl s_client -connect host:port -servername host

Replace host and port with the actual host name and port number of the server you are trying to connect to. You should see the server certificate and its chain of trust. Look for any errors or warnings, such as Verify return code: 21 (unable to verify the first certificate).

Keytool: Run the following command in a terminal:

keytool -printcert -sslserver host:port

1	keytool -printcert -sslserver host:port

Replace host and port with the actual host name and port number of the server you are trying to connect to. You should see the server certificate and its chain of trust. Look for any errors or warnings, such as Certificate does not conform to RFC3280: invalid BasicConstraints.

Install or update the root and intermediate certificates on your client machine

The second step is to install or update the root and intermediate certificates on your client machine, so that your client can trust the server certificate. You can do this by following these steps:

Download the root and intermediate certificates from a trusted source, such as https://www.digicert.com/kb/digicert-root-certificates.htm.
Open Control Panel -> Internet Options -> Content tab. Click Certificates and then Import. Follow the wizard to import the root and intermediate certificates into the Trusted Root Certification Authorities and Intermediate Certification Authorities stores respectively.
Click Clear SSL State button and restart your browser or application.

Use the correct host name or override the certificate validation

The final step is to use the correct host name or override the certificate validation when connecting to the server. You can do this by using one of these methods:

Use the correct host name: Make sure that you are using the same host name that matches the common name (CN) or subject alternative name (SAN) of the server certificate. For example, if the server certificate is issued to imap.example.com, you should use imap.example.com as your host name, not example.com or localhost.
Override the certificate validation: If you are sure that you are connecting to a trusted server, you can override the certificate validation by using a custom callback method that returns true for any certificate. For example, if you are using HttpClient, you can use this code:

using System.Net.Http;
using System.Net.Security;

var handler = new HttpClientHandler();
handler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true;
var client = new HttpClient(handler);
// use client to make requests

using System.Net.Http;

using System.Net.Security;

var handler = new HttpClientHandler();

handler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true;

var client = new HttpClient(handler);

// use client to make requests

Note: This method is not recommended for production environments, as it bypasses all security checks and exposes your client to potential man-in-the-middle attacks.

By following these steps, you should be able to solve The remote certificate is invalid because of errors in the certificate chain error and connect to your web API or web service using SSL.