Hi.

I am currently integrating a payment gateway into an application. Following a successful transaction the remote payment gateway posts details of the transaction back to my application (ITN). It posts to a HttpHandler that is used to read and validate the data.

Part of the validation performed is a POST made by the handler to a validation service provided by the payment gateway. This effectively posts some of the original form values received back to the payment gateway to ensure they are valid.

The url that I am posting back to is: "https://sandbox.payfast.co.za/eng/query/validate"

and the code I am using:

        /// <summary>
    /// Posts the data back to the payment processor to validate the data received
    /// </summary>
    public static bool ValidateITNRequestData(NameValueCollection formVariables) {
        bool isValid = true;
        try {              
            using (WebClient client = new WebClient()) {
                string validateUrl = (UseSandBox) ? SandboxValidateUrl : LiveValidateUrl;
                byte[] responseArray = client.UploadValues(validateUrl, "POST", formVariables);

                // get the resposne and replace the line breaks with spaces
                string result = Encoding.ASCII.GetString(responseArray);
                result = result.Replace("\r\n", " ").Replace("\r", "").Replace("\n", " ");

                if (result == null || !result.StartsWith("VALID")) {
                    isValid = false;
                    LogManager.InsertLog(LogTypeEnum.OrderError, "PayFast ITN validation failed",
                        "The validation response was not valid.");
                }
            }
        } catch (Exception ex) {
            LogManager.InsertLog(LogTypeEnum.Unknown, "Unable to validate ITN data. Unknown exception", ex);
            isValid = false;
        }
        return isValid;
    }

However, on calling WebClient.UploadValues the following exception is raised:

System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. at System.Net.Security.SslState.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, Exception exception) at 

For the sake of brevity I haven't listed the full call stack (I can do if anyone thinks it will help).

The remote certificate does appear to be valid. To get around the problem I did try adding a new RemoteCertificateValidationCallback that always returned true but just ended up getting the following exception:

System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed. at System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet) at System.Security.CodeAccessPermission.Demand() at System.Net.ServicePointManager.set_ServerCertificateValidationCallback(RemoteCertificateValidationCallback value) at NopSolutions.NopCommerce.Payment.Methods.PayFast.PayFastPaymentProcessor.ValidateITNRequestData(NameValueCollection formVariables) The action that failed was: Demand The type of the first permission that failed was: System.Security.Permissions.SecurityPermission The Zone of the assembly that failed was: MyComputer

So I am not sure this will work in medium trust?

Any help would be much appreciated. Thanks Ben