Pass Through Host Certificate Validation

Choose whether to enable or disable the default certificate validation process during SSL/TLS handshake. By default, the certificate validation is enabled. Applicable only for Microsoft schannel provider.
Note:
By default, schannel (MSCAPI) is responsible for validating the host certificate chain received during SSL/TLS handshake.

Schannel runs several checks on the received certificate chain one of which is verifying that the signature affixed to the certificate is valid, that is, the hash value computed on the certificate contents matches the value that results from decrypting the signature field using the public component of the issuer. To perform this operation, the user must possess the issuer’s public component, either through some integrity-assured channel or by extracting it from another (validated) certificate. The default certificate validation process is exhaustive and runs several checks on the host certificate chain to successfully validate it. Enable this option the user would effectively suppress the default validation done by schannel and the identity of the host is not verified. As we are skipping the host certificate validation, the status bar is updated with the following message. “Skipping the certificate validation since pass-through host certificate validation option is enabled.” The use of this option is not recommended.

When the Host certificate is not added to the trusted root and “Pass-Through Host Certificate Validation” is enabled, a pop-up is displayed. Users can suppress this pop-up by adding the “SuppressPassThroughPopup=Y” keyword under the “[Security]” section in the pcswin.ini file. By default, the SuppressPassThroughPopup is disabled.