Repository: microsoft/garnet
File: libs/server/TLS/GarnetTlsOptions.cs (C#)

Code before:
        /// <summary>
        /// Callback to verify the TLS certificate
        /// </summary>
        /// <param name="issuerCertificatePath"></param>
        /// <returns></returns>
        /// <exception cref="ArgumentException"></exception>
        /// <exception cref="ArgumentNullException"></exception>
        RemoteCertificateValidationCallback ValidateClientCertificateCallback(string issuerCertificatePath)
        {
            if (!ClientCertificateRequired)
            {
                logger?.LogWarning("ClientCertificateRequired is false. Remote certificate validation will always succeed.");
                return (object _, X509Certificate certificate, X509Chain __, SslPolicyErrors sslPolicyErrors)
                    => true;
            }
            var issuer = GetCertIssuer(issuerCertificatePath);
            return (object _, X509Certificate certificate, X509Chain __, SslPolicyErrors sslPolicyErrors)
                => (sslPolicyErrors == SslPolicyErrors.None) || (sslPolicyErrors == SslPolicyErrors.RemoteCertificateChainErrors
                    && certificate is X509Certificate2 certificate2
                    && ValidateCertificateIssuer(certificate2, issuer));
        }

        /// <summary>
        /// Returns issuer certificate in X509Certificate2 format.
        /// </summary>
        /// <param name="issuerCertificatePath">path to issuer cert.</param>
        X509Certificate2 GetCertIssuer(string issuerCertificatePath)
        {
            X509Certificate2 issuer = null;
            if (!string.IsNullOrEmpty(issuerCertificatePath))
            {
                try
                {
                    issuer = new X509Certificate2(issuerCertificatePath);
                }
                catch (Exception ex)
                {
                    logger?.LogError(ex, "Error loading issuer certificate");
                    throw;
                }
            }
            else
                logger?.LogWarning("ClientCertificateRequired is true and IssuerCertificatePath is not provided. The remote certificate chain will not be validated against issuer.");

            return issuer;
        }

        /// <summary>
        /// Check the chain certificate and determine if the certificate is valid. NOTE: This is prototype code based on
        /// https://stackoverflow.com/questions/6497040/how-do-i-validate-that-a-certificate-was-created-by-a-particular-certification-a
        /// Make sure to validate for your requirements before using in production.

Review comment (refactor):
NIT: I'd clean up the comment a bit.

```suggestion
        /// <summary>
        /// Loads an issuer X.509 certificate using its file name.
        /// </summary>
        /// <param name="issuerCertificatePath">The path of the certificate file.</param>
```

Code after:
        /// </summary>
        /// <param name="issuerCertificatePath">The path to issuer certificate file.</param>
        /// <returns>The RemoteCertificateValidationCallback delegate to invoke.</returns>
        RemoteCertificateValidationCallback ValidateClientCertificateCallback(string issuerCertificatePath)
        {
            if (!ClientCertificateRequired)
            {
                logger?.LogWarning("ClientCertificateRequired is false. Remote certificate validation will always succeed.");
                return (object _, X509Certificate certificate, X509Chain __, SslPolicyErrors sslPolicyErrors)
                    => true;
            }
            var issuer = GetCertificateIssuer(issuerCertificatePath);
            return (object _, X509Certificate certificate, X509Chain __, SslPolicyErrors sslPolicyErrors)
                => (sslPolicyErrors == SslPolicyErrors.None) || (sslPolicyErrors == SslPolicyErrors.RemoteCertificateChainErrors
                    && certificate is X509Certificate2 certificate2
                    && ValidateCertificateIssuer(certificate2, issuer));
        }

        /// <summary>
        /// Loads an issuer X.509 certificate using its file name.
        /// </summary>
        /// <param name="issuerCertificatePath">The path to issuer certificate file.</param>
        X509Certificate2 GetCertificateIssuer(string issuerCertificatePath)
        {
            X509Certificate2 issuer = null;
            if (!string.IsNullOrEmpty(issuerCertificatePath))
            {
                try
                {
                    issuer = new X509Certificate2(issuerCertificatePath);
                }
                catch (Exception ex)
                {
                    logger?.LogError(ex, "Error loading issuer certificate");
                    throw;
                }
            }
            else
                logger?.LogWarning("ClientCertificateRequired is true and IssuerCertificatePath is not provided. The remote certificate chain will not be validated against issuer.");

            return issuer;
        }

        /// <summary>
        /// Check the chain certificate and determine if the certificate is valid. NOTE: This is prototype code based on
        /// https://stackoverflow.com/questions/6497040/how-do-i-validate-that-a-certificate-was-created-by-a-particular-certification-a
        /// Make sure to validate for your requirements before using in production.
        /// </summary>
        /// <param name="certificateToValidate">X509Certificate2 certificate to be validated.</param>
        /// <param name="authority">X509Certificate2 representing the root cert.</param>
        /// <returns>A boolean indicating whether the certificate has a valid issuer.</returns>