Disabled certificate revocation (ARCH333)

Key dotnet.security.disabled-cert-revocation · Severity warning · Category security · CWE CWE-299

Disabling certificate revocation checks causes a revoked certificate (e.g. stolen or invalidated) to be accepted. This opens the door to man-in-the-middle attacks.

Incorrect

var handler = new HttpClientHandler
{
    CheckCertificateRevocationList = false
};
var client = new HttpClient(handler);

Correct

var handler = new HttpClientHandler
{
    CheckCertificateRevocationList = true
};
var client = new HttpClient(handler);

Fix

Set CheckCertificateRevocationList = true to keep revocation checks enabled and reject revoked certificates.