jaymedavis/stripe.net — pull request #156 by woodrow (2014-04-11 00:17:23+00:00)
Title: Add certificate blacklist to stripe.net

Stripe has recently added certificate blacklisting to our libraries in other languages [1] and I wanted to do the same for stripe.net. I've added the code and a test. I've tested this out on mono/linux, but would appreciate more feedback and testing.

One point: I'm not sure if i'm doing the "right" thing with `ServicePointManager.ServerCertificateValidationCallback`, but I don't know of any other way to correctly ensure that our callback is available prior to making a request, given that I can't control others' use of `ServicePointManager.ServerCertificateValidationCallback`. If you ever move to support .NET >= 4.5 only, you can do the following which is much nicer:
```diff
private static WebRequest GetWebRequest(string url, string method, string apiKey = null, bool useBearer = false)
{
apiKey = apiKey ?? StripeConfiguration.GetApiKey();

var request = (HttpWebRequest)WebRequest.Create(url);
request.Method = method;

if(!useBearer)
request.Headers.Add("Authorization", GetAuthorizationHeaderValue(apiKey));
else
request.Headers.Add("Authorization", GetAuthorizationHeaderValueBearer(apiKey));

request.ContentType = "application/x-www-form-urlencoded";
request.UserAgent = "Stripe.net (https://github.com/jaymedavis/stripe.net)";

+ // this only works for .NET 4.5+, unfortunately :(
+ request.ServerCertificateValidationCallback = StripeCertificateVerificationCallback;
+
return request;
}
```