Overview

Visual Studio 2015 provides the tools and frameworks for developing, managing, and deploying applications across Windows, web, cloud, and more. When deploying web applications using Visual Studio 2015, developers may encounter scenarios where they need to work with untrusted certificates, such as during the development and testing phases. This is particularly important for scenarios involving HTTPS endpoints. Allowing untrusted certificates can facilitate smoother testing and debugging processes, although it comes with security risks. In this article, we will explore how to handle deployments using untrusted SSL/TLS certificates in Visual Studio 2015.

SSL/TLS Certificates

SSL (Secure Socket Layer) and TLS (Transport Layer Security) certificates are used to establish a secure channel between a client and a server. They ensure data confidentiality and integrity by encrypting the data. Normally, when a browser connects to a web server over HTTPS, it validates the server's SSL certificate against a trusted Certificate Authority (CA). However, during development and internal testing, self-signed or untrusted certificates are often used, which standard browsers or tools may not recognize as valid.

Allowing Untrusted Certificates in Visual Studio 2015

When you need to publish your application and the target server uses an untrusted certificate, you can configure Visual Studio to bypass certificate validation. Although this is not recommended for production environments, it can expedite development workflows.

Steps to Allow Untrusted Certificates

1. Configure the Web Application Publishing Settings:
   • In Visual Studio 2015, right-click your application project in Solution Explorer.
   • Select "Publish..." to open the publishing wizard.
   • Choose or configure a publish profile targeting your server.
2. Modify the Publish Profile:
   • Once you select a publish profile, there’s an option to edit additional settings. This may include setting up connection settings or a custom server API.
   • Often these files are located in the project directory under `Properties/PublishProfiles/`, and you can open the ```<YourProfile>``.pubxml` file.
3. Edit the Pubxml File Configuration:
   • Within the ```<YourProfile>``.pubxml` file, add the following setting inside the ```<PropertyGroup>``` tag:
   • This setting effectively tells MSDeploy to ignore errors related to untrusted certificates.
   • Return to the Visual Studio Publish interface and proceed with publishing.
   • The publish operation should no longer halt due to untrusted certificate warnings/errors.

• Security Risks: Allowing untrusted certificates is inherently unsafe as it can expose data to potential interception or man-in-the-middle attacks. Therefore, it’s essential to use this setting strictly within secure networks or development/test environments.
• Best Practices: Use trusted certificates in production and employ this configuration only temporarily during development stages. Coordinate with your IT or security teams to manage certificates appropriately.
• Browsers: During local testing, browsers might also flag sites with untrusted certificates. Developers can manually trust these in browsers settings for enhanced testing.
• Fiddler/Charles Proxy: For debugging network traffic, tools such as Fiddler or Charles Proxy can add and trust custom certificates.