"The remote certificate is invalid according to the validation procedure"
<p>This has been asked before but I am completely stuck and nothing so far has worked for me that has been listed in other questions. While this refers to Identity Server I think i have missed something in setting SSL up.</p>

<p>I have setup as follows (this is with IIS express not full IIS):</p>

<ul>
<li>Identity Server app: auth.testhost.com:44373/core</li>
<li>Web API service: <a href="https://localhost:44356/" rel="nofollow">https://localhost:44356/</a> </li>
</ul>

<p>I get the error in the title on the line:    </p>

<pre><code>app.UseIdentityServerBearerTokenAuthentication(options);
</code></pre>

<p>This is basically requesting some open configuration options from the server at auth.testhost.com:44373/core/.well-known/openid-configuration.</p>

<p>My options are:</p>

<pre><code>Authority = "https://auth.testhost.com:44373/core",
RequiredScopes = new List&lt;string&gt;() { "api" }
</code></pre>

<p>In some examples I see a client id and secret, but they are not available in the options for me: is this a problem?</p>

<p>If you need to see any identity server options please say and I'll post. 
I ran the following command to create a cert:</p>

<pre><code>makecert.exe -r -pe -n "CN=auth.testhost.com" -b 01/01/2000 -e 01/01/2036 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 -len 2048
</code></pre>

<p>This generated the certificate, which I then exported to Trusted Root Certification Authorities. </p>

<p>From what I can tell, the SSL port bindings should be handled by Visual Studio as I am using IIS Express. Below are the bindings it has:</p>

<pre><code>&lt;site name="Authenticator_V2" id="2"&gt;
                &lt;application path="/" applicationPool="Clr4IntegratedAppPool"&gt;
                    &lt;virtualDirectory path="/" physicalPath="c:\users\user\documents\visual studio 2015\Projects\Authenticator_V2\Authenticator_V2" /&gt;
                &lt;/application&gt;
                &lt;bindings&gt;
                    &lt;binding protocol="http" bindingInformation="*:49755:localhost" /&gt;
                    &lt;binding protocol="https" bindingInformation="*:44373:localhost" /&gt;
                    &lt;binding protocol="https" bindingInformation="*:44373:auth.testhost.com" /&gt;
                &lt;/bindings&gt;
            &lt;/site&gt;
&lt;site name="APIClient2" id="7"&gt;
                &lt;application path="/" applicationPool="Clr4IntegratedAppPool"&gt;
                    &lt;virtualDirectory path="/" physicalPath="C:\Users\user\documents\visual studio 2015\Projects\Authenticator_V2\APIClient2" /&gt;
                &lt;/application&gt;
                &lt;bindings&gt;
                    &lt;binding protocol="http" bindingInformation="*:53812:localhost" /&gt;
                    &lt;binding protocol="https" bindingInformation="*:44356:localhost" /&gt;
                &lt;/bindings&gt;
            &lt;/site&gt;
</code></pre>

<p>This is my hosts file:</p>

<pre><code>127.0.0.1               localhost
127.0.0.1               hybrid.testhost.com
127.0.0.1               auth.testhost.com
</code></pre>

<p>When I go to <a href="https://auth.testhost.com:44373/" rel="nofollow">https://auth.testhost.com:44373/</a> I still have a red line through my protocol. I assume this means something has not been configured correctly still. I am using Chrome and clicking on the certificate gives:</p>

<pre><code>"Your connection to this site is not private." 
</code></pre>

<p>Details:</p>

<pre><code>SHA-1 Certificate
The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1.

View certificate

Certificate Error
There are issues with the site's certificate chain (net::ERR_CERT_COMMON_NAME_INVALID).
</code></pre>

<p>I looked at the ERR_CERT_COMMON_NAME_INVALID error and it seems that is a chrome bug. However my error is being thrown from the web services server trying to connect to the authentication server so I think I can ignore this one???</p>

<p>I also ran netsh to check there was a cert binding set up:</p>

<pre><code>netsh http show sslcert ipport=0.0.0.0:44373

SSL Certificate bindings:
-------------------------

    IP:port                      : 0.0.0.0:44373
    Certificate Hash             : HAS ODD HASH - REMOVED
    Application ID               : {HAS GUID - REMOVED}
    Certificate Store Name       : MY
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : (null)
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled
    Reject Connections           : Disabled
</code></pre>

<p>At this point a noticed this hash is not the right one for my certificate. It is for the IIS Express localhost. I found this link: <a href="https://stackoverflow.com/questions/28032215/identityserver-the-remote-certificate-is-invalid-according-to-the-validation-pr">IdentityServer: The remote certificate is invalid according to the validation procedure</a> and copied the steps to move the localhost certificate into the Trusted Root Certification Authorities but unfortunately I still have the error. I now am not sure what else to do.</p>

<p>Scope Configuration:</p>

<pre><code>new Scope
{
    Name = "api",
    DisplayName = "Can call API",
    Enabled = true,
    Type = ScopeType.Resource
    //ScopeSecrets = new List&lt;Secret&gt; {  }
}
</code></pre>

<p>All my clients have this scope.</p>

<p>Thanks</p>