Restore TLS certificate validation in Veeam connectors

[idoshabi07]

Summary

Removes accept-all certificate callbacks from the VONE and VBR clients, restores platform TLS validation, deletes the unreachable custom callback, and adds targeted tests.

AI scan items

• https://dev.azure.com/MSecProductSecurity/AI%20Vuln%20Scanning/_workitems/edit/130009
• https://dev.azure.com/MSecProductSecurity/AI%20Vuln%20Scanning/_workitems/edit/130199

Validation

Test execution requires private Veeam packages that are unavailable from the configured package sources.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Restores default TLS certificate validation in the Veeam VONE/VBR connectors by removing accept-all certificate callbacks and adding unit tests to prevent regressions.

Changes:

• Removed the custom “accept any cert” validation callback paths (including deleting the unreachable callback implementation).
• Updated VONE client construction to use a default HttpClientHandler without custom certificate validation.
• Added unit tests to assert platform TLS validation is used for both VBR and VONE clients.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Solutions/Veeam/Data Connectors/AzureFunctionVeeam/Veeam.Sentinel.FunctionApp/Client/CertificateValidation.cs	Deletes the unused/unreachable custom certificate validation class.
Solutions/Veeam/Data Connectors/AzureFunctionVeeam/Veeam.Sentinel.FunctionApp/Client/AuthenticatedVoneClientHandler.cs	Removes accept-all cert callback and centralizes handler creation.
Solutions/Veeam/Data Connectors/AzureFunctionVeeam/Veeam.Sentinel.FunctionApp/Client/AuthenticatedVbrClientHandler.cs	Removes custom remote certificate validation callback wire-up.
Solutions/Veeam/Data Connectors/AzureFunctionVeeam/Veeam.Sentinel.FunctionApp.Tests/Client/TlsValidationShould.cs	Adds tests asserting no custom TLS validation callbacks are set.
Solutions/Veeam/Data Connectors/AzureFunctionVeeam/Veeam.Sentinel.FunctionApp.Tests/Client/TestableAuthenticatedVoneClientHandler.cs	Adds a testable wrapper to call handler factory method.
Solutions/Veeam/Data Connectors/AzureFunctionVeeam/Veeam.Sentinel.FunctionApp.Tests/Client/TestableAuthenticatedVbrClientHandler.cs	Exposes whether VBR RestClient has a custom cert callback configured.

Suppressed comments (1)

Solutions/Veeam/Data Connectors/AzureFunctionVeeam/Veeam.Sentinel.FunctionApp/Client/AuthenticatedVoneClientHandler.cs:93

• CreateHttpClientHandler() is protected static, which makes it harder to customize behavior via subclassing (static methods can’t be overridden) and forces tests to add a derived type solely to expose it. If the intent is extensibility and testability, consider making it an instance protected virtual factory method or injecting a handler/factory (e.g., via constructor) so tests can validate the actual handler used without needing a special wrapper class.

        protected static VoneConfiguration CreateVoneConfig(string baseUrl)
        {
            var handler = CreateHttpClientHandler();

            var httpClient = new HttpClient(handler)
            {
                BaseAddress = new Uri(baseUrl)
            };

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.