UnityWebRequest Custom Certificate Validation: Missing Env Toggle

UnityWebRequest Custom Certificate Validation

Developers often need to accept self‑signed certificates when connecting to local or staging servers. The current API requires a custom CertificateHandler subclass that overrides ValidateCertificate(byte[]) and embeds any environment‑based logic. There is no built‑in switch to automatically bypass validation for dev or staging domains, and the behavior varies across iOS, Android, and Windows, complicating cross‑platform builds.

In Unity 2023.x, iOS 15+ rejects incomplete chains even if a custom handler returns true, which raises the question of whether the networking module should honor the handler or enforce a stricter policy. The absence of a higher‑level API leaves the decision to the developer, increasing the risk of accidental exposure of insecure validation in production.

What would be the consequences of introducing a global AllowInsecureCertificates flag scoped to a domain list? How could such a flag be safely gated behind build or runtime configuration to avoid accidental leakage? Would a dedicated UnityWebRequest.SetInsecureDomains method simplify the current pattern?