Repository navigation
XS✔ ◾ Restore TLS certificate validation for health-check clients - #903
Closed
Marc Hayek (marc-hayek) wants to merge 1 commit into
Closed
Marc Hayek (marc-hayek) wants to merge 1 commit into
Marc Hayek (marc-hayek) wants to merge 1 commit into
Conversation
Remove unconditional certificate acceptance from named and legacy health-check clients while preserving existing handler settings. Update documentation and add regression coverage for the registered handlers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 97fd4f9b-6689-4de9-bea3-3cbe15794b28
Marc Hayek (marc-hayek)
deployed
to
github-app-main
October 16, 2026 14:37 — with 
GitHub Actions
Active
GitHub Actions
Active
Contributor
PR Metrics✔ Thanks for keeping your pull request small.
Metrics computed by PR Metrics. Add it to your Azure DevOps and GitHub PRs! |
microsoft-omex
Bot
changed the title
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused changes restore certificate validation, preserve client settings, and include regression coverage without identified blocking issues.
0 open findings
What changed in this PR
Restores platform TLS certificate validation for both health-check client registrations, taking the stricter approach described as an alternative to #902.
Changes:
- Removes unconditional certificate acceptance while preserving existing client settings.
- Corrects XML documentation and adds handler-configuration regression tests.
| File | Description |
|---|---|
| tests/Diagnostics.HealthChecks.UnitTests/ServiceCollectionExtensions.cs | Tests default validation and preserved legacy settings. |
| src/Diagnostics.HealthChecks/ServiceCollectionExtensions.cs | Removes the legacy client's certificate bypass. |
| src/Diagnostics.HealthChecks/HealthCheckHttpClientServiceCollectionExtensions.cs | Removes the named-client bypass and updates documentation. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AddHealthCheckHttpClientand the legacy publisher health-check client registration.HttpClientHandler, and the legacy client's redirect and default-credential settings.IHttpMessageHandlerFactory.Compatibility and rollout
HTTP health checks are unaffected. HTTPS health checks must present a trusted, valid certificate matching the configured hostname or IP address. Probes relying on untrusted/self-signed, expired, or hostname-mismatched certificates will fail after this change; their certificate, trust, or endpoint-address configuration must be corrected before rollout. Downstream service configurations have not been validated by this PR.
Validation
Diagnostics.HealthChecks.UnitTests: 91 passed.Diagnostics.HealthChecks.AspNetCore.UnitTests: 26 passed.git diff --checkpassed.Relationship to #902
This is a stricter alternative to #902, not an additional change intended to merge unchanged alongside it. It uses default certificate validation rather than introducing local/IP-address or Development exceptions, and also fixes the independent legacy registration. Reviewers should coordinate the two approaches before merging.