Disable TLS certificate validation when disableTLSCertificateValidation is set in the config file for a source.

src/NuGet.Core/NuGet.Protocol/HttpSource/HttpHandlerResourceV3Provider.cs

@@ -6,6 +6,8 @@
 using System.Linq;
 using System.Net;
 using System.Net.Http;
+using System.Net.Security;
+using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 using System.Threading.Tasks;
 using NuGet.Configuration;
@@ -56,6 +58,11 @@ private HttpHandlerResourceV3 CreateResource(PackageSource packageSource)
                 AutomaticDecompression = (DecompressionMethods.GZip | DecompressionMethods.Deflate),
             };
 
+            if (packageSource.DisableTLSCertificateValidation)
+            {
+                clientHandler.ServerCertificateCustomValidationCallback = (HttpRequestMessage message, X509Certificate2 cert, X509Chain chain, SslPolicyErrors errors) => true;
+            }
+
 #if IS_DESKTOP
             if (packageSource.MaxHttpRequestsPerSource > 0)
             {

test/NuGet.Core.Tests/NuGet.Protocol.Tests/HttpHandlerResourceV3ProviderTests.cs

@@ -6,6 +6,7 @@
 using System.Linq;
 using System.Net;
 using System.Net.Http;
+using System.Net.Security;
 using System.Threading;
 using System.Threading.Tasks;
 using FluentAssertions;
@@ -124,5 +125,45 @@ static IEnumerable<DelegatingHandler> GetDelegatingHandlers(HttpMessageHandler h
                 }
             }
         }
+
+        [Theory]
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task TryCreate_WhenCertificateValidationIsConfigured_HandlerShouldReflectConfiguration(bool disableCertificateValidation)
+        {
+            // Arrange
+            Mock<IProxyCache> proxyCache = new();
+            proxyCache.Setup(pc => pc.GetProxy(It.IsAny<Uri>())).Returns((IWebProxy)null);
+
+            PackageSource packageSource = new(_testPackageSourceURL, "source")
+            {
+                DisableTLSCertificateValidation = disableCertificateValidation
+            };
+
+            SourceRepository sourceRepository = new(packageSource, Array.Empty<INuGetResourceProvider>());
+
+            HttpHandlerResourceV3Provider target = new(proxyCache.Object);
+
+            // Act
+            var result = await target.TryCreate(sourceRepository, CancellationToken.None);
+
+            // Assert
+            result.Item1.Should().BeTrue();
+            HttpHandlerResourceV3 resource = (HttpHandlerResourceV3)result.Item2;
+            resource.Should().NotBeNull();
+
+            HttpClientHandler clientHandler = resource.ClientHandler;
+
+            if (disableCertificateValidation)
+            {
+                clientHandler.ServerCertificateCustomValidationCallback.Should().NotBeNull();
+                var callbackResult = clientHandler.ServerCertificateCustomValidationCallback.Invoke(null, null, null, SslPolicyErrors.RemoteCertificateChainErrors);
+                callbackResult.Should().BeTrue();
+            }
+            else
+            {
+                clientHandler.ServerCertificateCustomValidationCallback.Should().BeNull();
+            }
+        }
     }
 }