Ignore revocation checking failures on HTTPS tests on OSX #116910
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR enhances logging for certificate validation errors in the HttpClientHandler tests by outputting detailed information about each certificate in the chain along with associated error statuses.
- Added a loop to iterate through all certificate chain elements and output certificate details and status information.
- Logged overall SSL policy errors at the end of the callback.
github-actions
bot
added
the
needs-area-label
|
/azp run runtime-libraries-coreclr outerloop |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run runtime-libraries-coreclr outerloop-osx |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run runtime-libraries-coreclr outerloop |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run runtime-libraries-coreclr outerloop |
|
Azure Pipelines successfully started running 1 pipeline(s). |
rzikm
changed the title
rzikm
added
area-System.Net.Http
and removed
needs-area-label
|
Tagging subscribers to this area: @dotnet/ncl |
|
are we forcing customers to basically do the same? |
for customers, the right way to fix this would be disabling certificate revocation checking, but it is true that this might start affecting more people than we originally expected. I am wondering if we should consider different default for OSX. |
| // https://github.com/dotnet/corefx/issues/21922#issuecomment-315555237 | ||
| X509ChainStatusFlags flags = chain.ChainStatus.Aggregate(X509ChainStatusFlags.NoError, (cur, status) => cur | status.Status); | ||
| if (RuntimeInformation.IsOSPlatform(OSPlatform.OSX) && | ||
| flags == X509ChainStatusFlags.RevocationStatusUnknown && |
There was a problem hiding this comment.
If RevocationStatusUnknown is causing failure on macOS, but not on Windows or Linux, then that's a bug in the cert layer.
If it's just that macOS comes back with RevocationStatusUnknown and the others don't... that's not a thing we can really fix. But, you/we could decide that SslStream's default chain policy should say that RevocationStatusUnknown should not be considered as failure. (That'd be ChainPolicy.RevocationFlags)
This PR applies similar fix as in #22644 to Outerloop HTTPS tests where we check exact certificate validation errors. Additional context is also available at #25872