The remote certificate is invalid according to the validation procedure: RemoteCertificateNameMismatch

Older .NET versions printed only "The remote certificate is invalid according to the validation procedure." without naming the error; current .NET appends the SslPolicyErrors value. HttpClient wraps it in "The SSL connection could not be established, see inner exception."

.NET SslStream / HttpClient — SslPolicyErrors.RemoteCertificateNameMismatch

What it means

The server's certificate chain is trusted, but the host name .NET connected to is not among the names the certificate was issued for (its Subject Alternative Names). The text "according to the validation procedure" is used for SslPolicyErrors such as name mismatches, as opposed to "errors in the certificate chain" for trust and date problems.

Why it happens

• The certificate does not list this host name

  common

  A new subdomain, an environment name or the bare domain missing from the SAN list.

• Connecting by IP address, localhost or a container alias

  common

  Service names in docker-compose or Kubernetes and raw IP addresses are not in certificates issued for public names.

• SQL Server connections by IP or alias with Encrypt=True

  occasional

  Microsoft.Data.SqlClient validates the server certificate by default (Encrypt=True since version 4); connecting by IP or a short name to a server whose certificate carries its FQDN fails the name check.

How to fix it

1. 1.

   Compare the certificate's names with the URL

   Print the SAN list of the served certificate.

   echo | openssl s_client -connect api.example.com:443 -servername api.example.com 2>/dev/null \
     | openssl x509 -noout -subject -ext subjectAltName

2. 2.

   Connect with a name from the certificate

   Change the URL and name resolution rather than switching validation off.

   // Use a host name from the certificate in the URL (resolve it to the address you need via DNS)
   using var client = new HttpClient();
   var response = await client.GetAsync("https://www.example.com/health");

3. 3.

   SQL Server: set HostNameInCertificate

   Microsoft.Data.SqlClient 5.0 and later accept HostNameInCertificate so you can connect by address while validating the certificate's real name; TrustServerCertificate=True instead skips all validation and should not be used outside throwaway environments.

   # Microsoft.Data.SqlClient: connect by IP/alias but validate against the certificate's name
   Server=10.0.0.5;Database=app;Encrypt=True;HostNameInCertificate=sql01.corp.example.com;

← Browse the full signature error database