There should be a version of HCHttpCallRequestSetSSLValidation for web sockets

[StephenE]

I am adding support for Web Sockets to our title, and have been testing my work with a very simple locally run echo server. Everything works fine when testing over http, but switching to https fails as I am just using a self signed certificate for local testing.

For making HTTP calls, I call HCHttpCallRequestSetSSLValidation to skip the ssl validation, but there is no equivilent for web sockets. I found HCWebSocketSetProxyDecryptsHttps, and using a debugger to skip the empty proxy check was able to get a connection open over https with the ssl check bypassed. This is not sustainable in the long term, as I can't expect other developers to stick a breakpoint in a random bit of code and set a random variable to true.

Please consider adding a new function along the lines of HCWebSocketSetSSLValidation, which when called disables the SSL validation step.

[jplafonta]

Thanks for the feedback. We will open a work item for this and hopefully get that work scheduled soon. Will leave this github issue open for the time being and reply here with progress.

[stonstad]

Has this issue been resolved?

[StephenEdmondsPG]

I ran into this issue myself today, same repo - using a self signed certificate, not able to skip the SSL validation checks

[jhugard]

Hi Stephen Edmonds (@StephenE) — a few years late, but I was looking into exactly this area recently and I think the existing HCWebSocketSetProxyDecryptsHttps API may already do what you need — with a caveat.

The API works on the default WinHTTP WebSocket path on Win32, but it has a precondition: you must call HCWebSocketSetProxyUri() first, or SetProxyDecryptsHttps returns E_UNEXPECTED. From your description ("using a debugger to skip the empty proxy check"), it sounds like you hit exactly that gate.

The intended workflow is:

1. Point a local HTTPS-intercepting proxy at your self-signed server (Fiddler, Charles, mitmproxy, etc.)
2. HCWebSocketSetProxyUri(ws, "http://127.0.0.1:8888")
3. HCWebSocketSetProxyDecryptsHttps(ws, true)
4. Connect normally

This disables SECURITY_FLAG_IGNORE_UNKNOWN_CA and SECURITY_FLAG_IGNORE_CERT_CN_INVALID on the underlying WinHTTP request, which handles self-signed certs.

If you're looking to bypass cert validation without running a proxy — e.g., connecting directly to a dev server with a self-signed cert — then you're right that there's a gap in the API. There's no HCWebSocketSetSSLValidation that works independently of proxy configuration. That would be a cleaner API for the self-signed cert use case.

Was a local intercepting proxy an option for your setup, or did you specifically need direct-connect with cert bypass?

[StephenEdmondsPG]

I was not using HCWebSocketSetProxyUri at the time, but thanks for the suggestion. I won't be able to give this a try for quite a while, but if/when I get a chance, I'll try to remember to post back here with if it worked for my use case.