Kestrel Override Client Cert Validation

src/Servers/Kestrel/Core/src/HttpsConnectionAdapterOptions.cs

@@ -18,6 +18,7 @@ namespace Microsoft.AspNetCore.Server.Kestrel.Https
     public class HttpsConnectionAdapterOptions
     {
         private TimeSpan _handshakeTimeout;
+        private Func<X509Certificate2, X509Chain, SslPolicyErrors, bool> _clientCertificateValidation;
 
         /// <summary>
         /// Initializes a new instance of <see cref="HttpsConnectionAdapterOptions"/>.
@@ -58,7 +59,14 @@ public HttpsConnectionAdapterOptions()
         /// <summary>
         /// Specifies a callback for additional client certificate validation that will be invoked during authentication.
         /// </summary>
-        public Func<X509Certificate2, X509Chain, SslPolicyErrors, bool> ClientCertificateValidation { get; set; }
+        public Func<X509Certificate2, X509Chain, SslPolicyErrors, bool> ClientCertificateValidation {
+            get
+            {
+                return AllowAnyClientCertificate ? (_, __, ___) => true : _clientCertificateValidation;
+            }
+
+            set => _clientCertificateValidation = value;
+        }
 
         /// <summary>
         /// Specifies allowable SSL protocols. Defaults to <see cref="SslProtocols.Tls12" /> and <see cref="SslProtocols.Tls11"/>.
@@ -76,6 +84,11 @@ public HttpsConnectionAdapterOptions()
         /// </summary>
         public bool CheckCertificateRevocation { get; set; }
 
+        /// <summary>
+        /// When set to true, allows any client certificate.
+        /// </summary>
+        public bool AllowAnyClientCertificate { get; set; }
+
         /// <summary>
         /// Provides direct configuration of the <see cref="SslServerAuthenticationOptions"/> on a per-connection basis.
         /// This is called after all of the other settings have already been applied.

src/Servers/Kestrel/Kestrel/test/HttpsConnectionAdapterOptionsTest.cs

@@ -1,7 +1,8 @@
-// Copyright (c) .NET Foundation. All rights reserved.
+// Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using System.Net.Security;
 using System.Threading;
 using Microsoft.AspNetCore.Server.Kestrel.Core;
 using Microsoft.AspNetCore.Server.Kestrel.Https;
@@ -17,6 +18,19 @@ public void HandshakeTimeoutDefault()
             Assert.Equal(TimeSpan.FromSeconds(10), new HttpsConnectionAdapterOptions().HandshakeTimeout);
         }
 
+        [Fact]
+        public void AllowAnyCertificateOverridesValidationFunc()
+        {
+            var connectionAdapterOptions = new HttpsConnectionAdapterOptions
+            {
+                ClientCertificateMode = ClientCertificateMode.RequireCertificate,
+                ClientCertificateValidation = (x509Cert, x509Chain, sslPolicyErrors) => false,
+                AllowAnyClientCertificate = true
+            };
+
+            Assert.True(connectionAdapterOptions.ClientCertificateValidation(null, null, SslPolicyErrors.None));
+        }
+
         [Theory]
         [MemberData(nameof(TimeoutValidData))]
         public void HandshakeTimeoutValid(TimeSpan value)

src/Servers/Kestrel/test/InMemory.FunctionalTests/HttpsConnectionMiddlewareTests.cs

@@ -343,7 +343,7 @@ void ConfigureListenOptions(ListenOptions listenOptions)
                 {
                     ServerCertificate = _x509Certificate2,
                     ClientCertificateMode = ClientCertificateMode.RequireCertificate,
-                    ClientCertificateValidation = (certificate, chain, sslPolicyErrors) => true
+                    AllowAnyClientCertificate = true
                 });
             }
 
@@ -392,7 +392,7 @@ void ConfigureListenOptions(ListenOptions listenOptions)
                 {
                     ServerCertificate = _x509Certificate2,
                     ClientCertificateMode = ClientCertificateMode.RequireCertificate,
-                    ClientCertificateValidation = (certificate, chain, sslPolicyErrors) => true
+                    AllowAnyClientCertificate = true
                 });
             }
 
@@ -507,7 +507,7 @@ void ConfigureListenOptions(ListenOptions listenOptions)
                 {
                     ServerCertificate = _x509Certificate2,
                     ClientCertificateMode = ClientCertificateMode.RequireCertificate,
-                    ClientCertificateValidation = (certificate, chain, sslPolicyErrors) => true
+                    AllowAnyClientCertificate = true
                 });
             }