Enforce SSL policy errors in custom certificate validation callback

[Copilot]

The ServerCertificateCustomValidationCallback in DockerMessageHandler discarded the sslPolicyErrors argument entirely, silently accepting connections with hostname mismatches or unavailable certificates as long as the chain built.

Changes

• DockerMessageHandler.cs: Capture sslPolicyErrors and reject the connection if any flag other than RemoteCertificateChainErrors is set. RemoteCertificateChainErrors is the only expected error when using a custom trust store and is already handled by chain.Build().

ServerCertificateCustomValidationCallback = (_, serverCert, chain, sslPolicyErrors) =>
{
    if (serverCert is null || chain is null || (sslPolicyErrors & ~SslPolicyErrors.RemoteCertificateChainErrors) != SslPolicyErrors.None)
    {
        return false;
    }

    chain.ChainPolicy.CustomTrustStore.Add(_caCert);
    chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
    return chain.Build(serverCert);
};

This ensures RemoteCertificateNameMismatch and RemoteCertificateNotAvailable are rejected outright rather than bypassed by a successful chain build.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

Tightens TLS security for Docker connections by ensuring the ServerCertificateCustomValidationCallback respects sslPolicyErrors, preventing acceptance of connections with hostname mismatches or missing certificates even if the chain build succeeds.

Changes:

• Add SslPolicyErrors evaluation in ServerCertificateCustomValidationCallback.
• Reject certificates when any SSL policy error other than RemoteCertificateChainErrors is present.
• Keep custom trust store / CustomRootTrust chain validation behavior for the expected chain error scenario.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.