See also Best practices for using ServerCertificateValidationCallback, which discusses some best practices when making HTTP requests to endpoints with custom certificate checking logic. However SmtpClient
doesn't seem to be exposing a similar property.
In my use-case, a multi-tenant saas, the smtp server is user-provided and unknown at compile time. Some user-provided servers are setup correctly and certificate validation should happen, while other servers aren't setup correctly and the user should have the ability to skip certificate validation. This means that I can't (shouldn't) disable certificate checking globally, and only disable certificate checking on a 1-by-1 basis for the lifetime of and scoped to an instance of SmtpClient
.
How does one typically do this?