Fix ServerCertificateCustomValidator on API 21-23 (#8637)

Follow-up to #8594 to fixdotnet/runtime#95506 on Android API 21-23

Author: simonrozsival

src/Mono.Android/Xamarin.Android.Net/ServerCertificateCustomValidator.cs

@@ -5,6 +5,8 @@
 usingSystem.Net.Security;
 usingSystem.Security.Cryptography.X509Certificates;
 
+usingAndroid.OS;
+usingAndroid.Runtime;
 usingJavax.Net.Ssl;
 
 usingJavaCertificateException=Java.Security.Cert.CertificateException;
@@ -25,9 +27,9 @@ public ServerCertificateCustomValidator (Func<HttpRequestMessage, X509Certificat
 
 publicITrustManager[]ReplaceX509TrustManager(ITrustManager[]?trustManagers,HttpRequestMessagerequestMessage)
 {
-varoriginalX509TrustManager=FindX509TrustManager(trustManagers);
+varoriginalX509TrustManager=FindX509TrustManager(trustManagers,outintoriginalTrustManagerIndex);
 vartrustManagerWithCallback=newTrustManager(originalX509TrustManager,requestMessage,Callback);
-returnModifyTrustManagersArray(trustManagers,original:originalX509TrustManager,replacement:trustManagerWithCallback);
+returnModifyTrustManagersArray(trustManagers,originalTrustManagerIndex,trustManagerWithCallback);
 }
 
 privatesealedclassTrustManager:Java.Lang.Object,IX509TrustManager
@@ -161,27 +163,45 @@ private sealed class AlwaysAcceptingHostnameVerifier : Java.Lang.Object, IHostna
 
 [DynamicDependency(nameof(IX509TrustManager.CheckServerTrusted),typeof(IX509TrustManagerInvoker))]
 [DynamicDependency(nameof(IX509TrustManager.CheckServerTrusted),typeof(X509ExtendedTrustManagerInvoker))]
-privatestaticIX509TrustManagerFindX509TrustManager(ITrustManager[]trustManagers)
+privatestaticIX509TrustManagerFindX509TrustManager(ITrustManager[]trustManagers,outintindex)
 {
-foreach(vartrustManagerintrustManagers){
-if(trustManagerisIX509TrustManagertm)
-returntm;
+for(inti=0;i<trustManagers.Length;i++){
+vartrustManager=trustManagers[i];
+if(trustManagerisIX509TrustManagerx509TrustManager){
+index=i;
+returnx509TrustManager;
+}
+
+// On API 21-23, the default Java trust manager is TrustManagerImpl from Conscrypt. The class implements X509TrustManager
+// but the .NET pattern matching will fail in this case and we need to cast it explicitly.
+intapiLevel=(int)Build.VERSION.SdkInt;
+if(apiLevel<=23){
+if(IsTrustManagerImpl(trustManager)){
+index=i;
+returntrustManager.JavaCast<IX509TrustManager>();
+}
+}
 }
 
 thrownewInvalidOperationException($"Could not find {nameof(IX509TrustManager)} in {nameof(ITrustManager)} array.");
+
+staticboolIsTrustManagerImpl(ITrustManagertrustManager)
+{
+varjavaClassName=JNIEnv.GetClassNameFromInstance(trustManager.Handle);
+returnjavaClassName.Equals("com/android/org/conscrypt/TrustManagerImpl",StringComparison.Ordinal);
+}
 }
 
-privatestaticITrustManager[]ModifyTrustManagersArray(ITrustManager[]trustManagers,IX509TrustManageroriginal,IX509TrustManagerreplacement)
+privatestaticITrustManager[]ModifyTrustManagersArray(ITrustManager[]trustManagers,intoriginalTrustManagerIndex,IX509TrustManagerreplacement)
 {
 varmodifiedTrustManagersArray=newITrustManager[trustManagers.Length];
 
 for(inti=0;i<trustManagers.Length;i++){
-if(trustManagers[i]==original){
+if(i==originalTrustManagerIndex){
 modifiedTrustManagersArray[i]=replacement;
 }else{
 modifiedTrustManagersArray[i]=trustManagers[i];
 }
-
 }
 
 returnmodifiedTrustManagersArray;