Wildcard Certificate Validation Limits for Multi‑Level Subdomains in Visual Studio

Answer

The .NET runtimes that ship with Visual Studio 2022 (up to version 17.8) enforce the RFC 6125 wildcard rule: a certificate for *.example.com is considered valid only for hostnames with exactly one additional label (e.g., bar.example.com). Hostnames with two or more extra labels, such as foo.bar.example.com, cause TLS validation to fail.

Which .NET versions enforce the limit?

• .NET Framework 4.8
• .NET 6 runtime
• .NET 7 runtime
• .NET 8 runtime

All of these are bundled with Visual Studio 2022 versions through at least 17.8, and they behave identically regarding wildcard matching.

Does Visual Studio 2022 17.8 or later expose a setting to relax the rule?

No. Visual Studio does not provide an IDE‑level option to modify wildcard validation; the behavior is controlled solely by the underlying .NET SslStream/Schannel implementation.

Recommended approach to allow connections like foo.bar.example.com

1. Implement a custom validation callback that accepts the certificate only for the expected host and verifies its thumbprint (or other trusted attributes).
2. For HttpClient use HttpClientHandler.ServerCertificateCustomValidationCallback; for lower‑level sockets use ServicePointManager.ServerCertificateValidationCallback or SslStream.AuthenticateAsClient with a validation delegate.
3. Example callback (pseudo‑code):

   bool ValidateCertificate(HttpRequestMessage request, X509Certificate2 certificate, X509Chain chain, SslPolicyErrors errors)
   {
       // Accept only if the hostname matches the target and the certificate is the known test cert
       if (request.RequestUri.Host.Equals("foo.bar.example.com", StringComparison.OrdinalIgnoreCase) &&
           certificate.Thumbprint.Equals("AB12CD34EF56...", StringComparison.OrdinalIgnoreCase))
       {
           return true;
       }
       // Otherwise rely on default validation
       return errors == SslPolicyErrors.None;
   }
   

4. Assign the callback before making the request:

   var handler = new HttpClientHandler { ServerCertificateCustomValidationCallback = ValidateCertificate };
   var client = new HttpClient(handler);
   

5. Limit the callback’s scope to development or test environments; never return true indiscriminately in production.

Verification steps

• Run dotnet --info or check Visual Studio’s “About” dialog to confirm the bundled .NET version.
• Create a minimal console app that attempts an HTTPS request to foo.bar.example.com using a *.example.com certificate and observe whether an AuthenticationException is thrown.
• Apply the custom callback as shown above and verify that the request succeeds while requests to unrelated hosts are rejected.