Support certificate validation TLS alerts for Linux by rzikm · Pull Request #115996 · dotnet/runtime

rzikm · 2025-05-26T13:37:46Z

Contributes to #18837.

Summary

On Linux, SslStream previously closed the transport without sending a TLS alert when certificate validation failed. This PR makes SslStream send appropriate TLS alerts (e.g. bad_certificate, unknown_ca, certificate_expired, certificate_required) by moving certificate validation inline into the OpenSSL handshake via SSL_CTX_set_cert_verify_cb.

How it works

Instead of validating the peer certificate after the handshake completes (post-handshake), the validation now runs inside OpenSSL's certificate verification callback during the handshake itself. This allows OpenSSL to send the appropriate TLS alert to the peer when validation fails, since the handshake is still in progress.

The CertVerifyCallback (registered on the SSL_CTX) extracts the certificate chain from the X509_STORE_CTX, then calls the existing managed VerifyRemoteCertificate logic — including the user's RemoteCertificateValidationCallback if one is registered. If validation fails, the callback maps the failure reason to an X509_V_ERR_* status code, which OpenSSL translates into the corresponding TLS alert.

Connection info during the callback

Because the callback fires mid-handshake, connection properties like SslProtocol and CipherAlgorithm would normally not be available yet. To preserve backward compatibility with user callbacks that access these properties, _connectionInfo is populated before invoking the user callback. On TLS 1.2, SSL_get_current_cipher() returns NULL at this point (the session cipher is set at ChangeCipherSpec), so the native code falls back to SSL_get_pending_cipher() which is available once ServerHello has been processed.

Propagating exceptions from validation callback

The exception that would normally be thrown from the cert validation (either AuthenticationException, or whatever user code throws) is caught and stored in SafeSslHandle before returning back to OpenSSL code, and when the control flow returns from SSL_do_handshake, the exception gets rethrown.

Client certificates and `ClientCertificateRequired`

OpenSSL only invokes the cert verify callback when the peer actually sends a certificate. When a server sets ClientCertificateRequired = true but the client sends no certificate, the callback never fires. Two cases are handled:

No user callback registered:SSL_VERIFY_FAIL_IF_NO_PEER_CERT is set alongside SSL_VERIFY_PEER, so OpenSSL itself rejects the handshake and sends the certificate_required (TLS 1.3) or handshake_failure (TLS 1.2) alert.
User callback registered: Only SSL_VERIFY_PEER is set. The handshake succeeds, and managed CompleteHandshake code detects that _remoteCertificate is still null, then calls VerifyRemoteCertificate which invokes the user's callback with SslPolicyErrors.RemoteCertificateNotAvailable. This preserves the existing behavior where applications can accept connections without a client certificate via the callback, unfortunately, no TLS alert is sent in this case.

Resumed sessions

On resumed sessions, OpenSSL skips the cert verify callback since the certificate was already validated in the original handshake. CompleteHandshake detects this (_remoteCertificate is null) and retrieves the peer certificate from the SSL handle via GetRemoteCertificate and valites it post-handshake, previous behavior is preserved (no TLS alert is sent if revalidation fails, but this is not expected to happen often in practice).

dotnet-policy-service · 2025-05-26T13:38:46Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Fixesdotnet#18837

dotnet-policy-service · 2025-08-01T03:28:16Z

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

liveans

LGTM

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

rzikm · 2026-04-15T08:24:01Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2026-04-15T08:24:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

rzikm · 2025-05-26T13:37:46Z

Contributes to #18837.

Summary

On Linux, SslStream previously closed the transport without sending a TLS alert when certificate validation failed. This PR makes SslStream send appropriate TLS alerts (e.g. bad_certificate, unknown_ca, certificate_expired, certificate_required) by moving certificate validation inline into the OpenSSL handshake via SSL_CTX_set_cert_verify_cb.

How it works

Instead of validating the peer certificate after the handshake completes (post-handshake), the validation now runs inside OpenSSL's certificate verification callback during the handshake itself. This allows OpenSSL to send the appropriate TLS alert to the peer when validation fails, since the handshake is still in progress.

The CertVerifyCallback (registered on the SSL_CTX) extracts the certificate chain from the X509_STORE_CTX, then calls the existing managed VerifyRemoteCertificate logic — including the user's RemoteCertificateValidationCallback if one is registered. If validation fails, the callback maps the failure reason to an X509_V_ERR_* status code, which OpenSSL translates into the corresponding TLS alert.

Connection info during the callback

Because the callback fires mid-handshake, connection properties like SslProtocol and CipherAlgorithm would normally not be available yet. To preserve backward compatibility with user callbacks that access these properties, _connectionInfo is populated before invoking the user callback. On TLS 1.2, SSL_get_current_cipher() returns NULL at this point (the session cipher is set at ChangeCipherSpec), so the native code falls back to SSL_get_pending_cipher() which is available once ServerHello has been processed.

Propagating exceptions from validation callback

The exception that would normally be thrown from the cert validation (either AuthenticationException, or whatever user code throws) is caught and stored in SafeSslHandle before returning back to OpenSSL code, and when the control flow returns from SSL_do_handshake, the exception gets rethrown.

Client certificates and `ClientCertificateRequired`

OpenSSL only invokes the cert verify callback when the peer actually sends a certificate. When a server sets ClientCertificateRequired = true but the client sends no certificate, the callback never fires. Two cases are handled:

No user callback registered:SSL_VERIFY_FAIL_IF_NO_PEER_CERT is set alongside SSL_VERIFY_PEER, so OpenSSL itself rejects the handshake and sends the certificate_required (TLS 1.3) or handshake_failure (TLS 1.2) alert.
User callback registered: Only SSL_VERIFY_PEER is set. The handshake succeeds, and managed CompleteHandshake code detects that _remoteCertificate is still null, then calls VerifyRemoteCertificate which invokes the user's callback with SslPolicyErrors.RemoteCertificateNotAvailable. This preserves the existing behavior where applications can accept connections without a client certificate via the callback, unfortunately, no TLS alert is sent in this case.

Resumed sessions

On resumed sessions, OpenSSL skips the cert verify callback since the certificate was already validated in the original handshake. CompleteHandshake detects this (_remoteCertificate is null) and retrieves the peer certificate from the SSL handle via GetRemoteCertificate and valites it post-handshake, previous behavior is preserved (no TLS alert is sent if revalidation fails, but this is not expected to happen often in practice).

dotnet-policy-service · 2025-05-26T13:38:46Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Fixesdotnet#18837

dotnet-policy-service · 2025-08-01T03:28:16Z

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

liveans

LGTM

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

rzikm · 2026-04-15T08:24:01Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2026-04-15T08:24:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

rzikm · 2025-05-26T13:37:46Z

Contributes to #18837.

Summary

On Linux, SslStream previously closed the transport without sending a TLS alert when certificate validation failed. This PR makes SslStream send appropriate TLS alerts (e.g. bad_certificate, unknown_ca, certificate_expired, certificate_required) by moving certificate validation inline into the OpenSSL handshake via SSL_CTX_set_cert_verify_cb.

How it works

Instead of validating the peer certificate after the handshake completes (post-handshake), the validation now runs inside OpenSSL's certificate verification callback during the handshake itself. This allows OpenSSL to send the appropriate TLS alert to the peer when validation fails, since the handshake is still in progress.

The CertVerifyCallback (registered on the SSL_CTX) extracts the certificate chain from the X509_STORE_CTX, then calls the existing managed VerifyRemoteCertificate logic — including the user's RemoteCertificateValidationCallback if one is registered. If validation fails, the callback maps the failure reason to an X509_V_ERR_* status code, which OpenSSL translates into the corresponding TLS alert.

Connection info during the callback

Because the callback fires mid-handshake, connection properties like SslProtocol and CipherAlgorithm would normally not be available yet. To preserve backward compatibility with user callbacks that access these properties, _connectionInfo is populated before invoking the user callback. On TLS 1.2, SSL_get_current_cipher() returns NULL at this point (the session cipher is set at ChangeCipherSpec), so the native code falls back to SSL_get_pending_cipher() which is available once ServerHello has been processed.

Propagating exceptions from validation callback

The exception that would normally be thrown from the cert validation (either AuthenticationException, or whatever user code throws) is caught and stored in SafeSslHandle before returning back to OpenSSL code, and when the control flow returns from SSL_do_handshake, the exception gets rethrown.

Client certificates and `ClientCertificateRequired`

OpenSSL only invokes the cert verify callback when the peer actually sends a certificate. When a server sets ClientCertificateRequired = true but the client sends no certificate, the callback never fires. Two cases are handled:

No user callback registered:SSL_VERIFY_FAIL_IF_NO_PEER_CERT is set alongside SSL_VERIFY_PEER, so OpenSSL itself rejects the handshake and sends the certificate_required (TLS 1.3) or handshake_failure (TLS 1.2) alert.
User callback registered: Only SSL_VERIFY_PEER is set. The handshake succeeds, and managed CompleteHandshake code detects that _remoteCertificate is still null, then calls VerifyRemoteCertificate which invokes the user's callback with SslPolicyErrors.RemoteCertificateNotAvailable. This preserves the existing behavior where applications can accept connections without a client certificate via the callback, unfortunately, no TLS alert is sent in this case.

Resumed sessions

On resumed sessions, OpenSSL skips the cert verify callback since the certificate was already validated in the original handshake. CompleteHandshake detects this (_remoteCertificate is null) and retrieves the peer certificate from the SSL handle via GetRemoteCertificate and valites it post-handshake, previous behavior is preserved (no TLS alert is sent if revalidation fails, but this is not expected to happen often in practice).

dotnet-policy-service · 2025-05-26T13:38:46Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Fixesdotnet#18837

dotnet-policy-service · 2025-08-01T03:28:16Z

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

liveans

LGTM

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

rzikm · 2026-04-15T08:24:01Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2026-04-15T08:24:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

rzikm · 2025-05-26T13:37:46Z

Contributes to #18837.

Summary

On Linux, SslStream previously closed the transport without sending a TLS alert when certificate validation failed. This PR makes SslStream send appropriate TLS alerts (e.g. bad_certificate, unknown_ca, certificate_expired, certificate_required) by moving certificate validation inline into the OpenSSL handshake via SSL_CTX_set_cert_verify_cb.

How it works

Instead of validating the peer certificate after the handshake completes (post-handshake), the validation now runs inside OpenSSL's certificate verification callback during the handshake itself. This allows OpenSSL to send the appropriate TLS alert to the peer when validation fails, since the handshake is still in progress.

The CertVerifyCallback (registered on the SSL_CTX) extracts the certificate chain from the X509_STORE_CTX, then calls the existing managed VerifyRemoteCertificate logic — including the user's RemoteCertificateValidationCallback if one is registered. If validation fails, the callback maps the failure reason to an X509_V_ERR_* status code, which OpenSSL translates into the corresponding TLS alert.

Connection info during the callback

Because the callback fires mid-handshake, connection properties like SslProtocol and CipherAlgorithm would normally not be available yet. To preserve backward compatibility with user callbacks that access these properties, _connectionInfo is populated before invoking the user callback. On TLS 1.2, SSL_get_current_cipher() returns NULL at this point (the session cipher is set at ChangeCipherSpec), so the native code falls back to SSL_get_pending_cipher() which is available once ServerHello has been processed.

Propagating exceptions from validation callback

The exception that would normally be thrown from the cert validation (either AuthenticationException, or whatever user code throws) is caught and stored in SafeSslHandle before returning back to OpenSSL code, and when the control flow returns from SSL_do_handshake, the exception gets rethrown.

Client certificates and `ClientCertificateRequired`

OpenSSL only invokes the cert verify callback when the peer actually sends a certificate. When a server sets ClientCertificateRequired = true but the client sends no certificate, the callback never fires. Two cases are handled:

No user callback registered:SSL_VERIFY_FAIL_IF_NO_PEER_CERT is set alongside SSL_VERIFY_PEER, so OpenSSL itself rejects the handshake and sends the certificate_required (TLS 1.3) or handshake_failure (TLS 1.2) alert.
User callback registered: Only SSL_VERIFY_PEER is set. The handshake succeeds, and managed CompleteHandshake code detects that _remoteCertificate is still null, then calls VerifyRemoteCertificate which invokes the user's callback with SslPolicyErrors.RemoteCertificateNotAvailable. This preserves the existing behavior where applications can accept connections without a client certificate via the callback, unfortunately, no TLS alert is sent in this case.

Resumed sessions

On resumed sessions, OpenSSL skips the cert verify callback since the certificate was already validated in the original handshake. CompleteHandshake detects this (_remoteCertificate is null) and retrieves the peer certificate from the SSL handle via GetRemoteCertificate and valites it post-handshake, previous behavior is preserved (no TLS alert is sent if revalidation fails, but this is not expected to happen often in practice).

dotnet-policy-service · 2025-05-26T13:38:46Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Fixesdotnet#18837

dotnet-policy-service · 2025-08-01T03:28:16Z

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

liveans

LGTM

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

rzikm · 2026-04-15T08:24:01Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2026-04-15T08:24:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

rzikm · 2025-05-26T13:37:46Z

Contributes to #18837.

Summary

On Linux, SslStream previously closed the transport without sending a TLS alert when certificate validation failed. This PR makes SslStream send appropriate TLS alerts (e.g. bad_certificate, unknown_ca, certificate_expired, certificate_required) by moving certificate validation inline into the OpenSSL handshake via SSL_CTX_set_cert_verify_cb.

How it works

Instead of validating the peer certificate after the handshake completes (post-handshake), the validation now runs inside OpenSSL's certificate verification callback during the handshake itself. This allows OpenSSL to send the appropriate TLS alert to the peer when validation fails, since the handshake is still in progress.

The CertVerifyCallback (registered on the SSL_CTX) extracts the certificate chain from the X509_STORE_CTX, then calls the existing managed VerifyRemoteCertificate logic — including the user's RemoteCertificateValidationCallback if one is registered. If validation fails, the callback maps the failure reason to an X509_V_ERR_* status code, which OpenSSL translates into the corresponding TLS alert.

Connection info during the callback

Because the callback fires mid-handshake, connection properties like SslProtocol and CipherAlgorithm would normally not be available yet. To preserve backward compatibility with user callbacks that access these properties, _connectionInfo is populated before invoking the user callback. On TLS 1.2, SSL_get_current_cipher() returns NULL at this point (the session cipher is set at ChangeCipherSpec), so the native code falls back to SSL_get_pending_cipher() which is available once ServerHello has been processed.

Propagating exceptions from validation callback

The exception that would normally be thrown from the cert validation (either AuthenticationException, or whatever user code throws) is caught and stored in SafeSslHandle before returning back to OpenSSL code, and when the control flow returns from SSL_do_handshake, the exception gets rethrown.

Client certificates and `ClientCertificateRequired`

OpenSSL only invokes the cert verify callback when the peer actually sends a certificate. When a server sets ClientCertificateRequired = true but the client sends no certificate, the callback never fires. Two cases are handled:

No user callback registered:SSL_VERIFY_FAIL_IF_NO_PEER_CERT is set alongside SSL_VERIFY_PEER, so OpenSSL itself rejects the handshake and sends the certificate_required (TLS 1.3) or handshake_failure (TLS 1.2) alert.
User callback registered: Only SSL_VERIFY_PEER is set. The handshake succeeds, and managed CompleteHandshake code detects that _remoteCertificate is still null, then calls VerifyRemoteCertificate which invokes the user's callback with SslPolicyErrors.RemoteCertificateNotAvailable. This preserves the existing behavior where applications can accept connections without a client certificate via the callback, unfortunately, no TLS alert is sent in this case.

Resumed sessions

On resumed sessions, OpenSSL skips the cert verify callback since the certificate was already validated in the original handshake. CompleteHandshake detects this (_remoteCertificate is null) and retrieves the peer certificate from the SSL handle via GetRemoteCertificate and valites it post-handshake, previous behavior is preserved (no TLS alert is sent if revalidation fails, but this is not expected to happen often in practice).

dotnet-policy-service · 2025-05-26T13:38:46Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Fixesdotnet#18837

dotnet-policy-service · 2025-08-01T03:28:16Z

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

liveans

LGTM

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

rzikm · 2026-04-15T08:24:01Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2026-04-15T08:24:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

rzikm · 2025-05-26T13:37:46Z

Contributes to #18837.

Summary

On Linux, SslStream previously closed the transport without sending a TLS alert when certificate validation failed. This PR makes SslStream send appropriate TLS alerts (e.g. bad_certificate, unknown_ca, certificate_expired, certificate_required) by moving certificate validation inline into the OpenSSL handshake via SSL_CTX_set_cert_verify_cb.

How it works

Instead of validating the peer certificate after the handshake completes (post-handshake), the validation now runs inside OpenSSL's certificate verification callback during the handshake itself. This allows OpenSSL to send the appropriate TLS alert to the peer when validation fails, since the handshake is still in progress.

The CertVerifyCallback (registered on the SSL_CTX) extracts the certificate chain from the X509_STORE_CTX, then calls the existing managed VerifyRemoteCertificate logic — including the user's RemoteCertificateValidationCallback if one is registered. If validation fails, the callback maps the failure reason to an X509_V_ERR_* status code, which OpenSSL translates into the corresponding TLS alert.

Connection info during the callback

Because the callback fires mid-handshake, connection properties like SslProtocol and CipherAlgorithm would normally not be available yet. To preserve backward compatibility with user callbacks that access these properties, _connectionInfo is populated before invoking the user callback. On TLS 1.2, SSL_get_current_cipher() returns NULL at this point (the session cipher is set at ChangeCipherSpec), so the native code falls back to SSL_get_pending_cipher() which is available once ServerHello has been processed.

Propagating exceptions from validation callback

The exception that would normally be thrown from the cert validation (either AuthenticationException, or whatever user code throws) is caught and stored in SafeSslHandle before returning back to OpenSSL code, and when the control flow returns from SSL_do_handshake, the exception gets rethrown.

Client certificates and `ClientCertificateRequired`

OpenSSL only invokes the cert verify callback when the peer actually sends a certificate. When a server sets ClientCertificateRequired = true but the client sends no certificate, the callback never fires. Two cases are handled:

No user callback registered:SSL_VERIFY_FAIL_IF_NO_PEER_CERT is set alongside SSL_VERIFY_PEER, so OpenSSL itself rejects the handshake and sends the certificate_required (TLS 1.3) or handshake_failure (TLS 1.2) alert.
User callback registered: Only SSL_VERIFY_PEER is set. The handshake succeeds, and managed CompleteHandshake code detects that _remoteCertificate is still null, then calls VerifyRemoteCertificate which invokes the user's callback with SslPolicyErrors.RemoteCertificateNotAvailable. This preserves the existing behavior where applications can accept connections without a client certificate via the callback, unfortunately, no TLS alert is sent in this case.

Resumed sessions

On resumed sessions, OpenSSL skips the cert verify callback since the certificate was already validated in the original handshake. CompleteHandshake detects this (_remoteCertificate is null) and retrieves the peer certificate from the SSL handle via GetRemoteCertificate and valites it post-handshake, previous behavior is preserved (no TLS alert is sent if revalidation fails, but this is not expected to happen often in practice).

dotnet-policy-service · 2025-05-26T13:38:46Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Fixesdotnet#18837

dotnet-policy-service · 2025-08-01T03:28:16Z

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

liveans

LGTM

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

rzikm · 2026-04-15T08:24:01Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2026-04-15T08:24:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

rzikm · 2025-05-26T13:37:46Z

Contributes to #18837.

Summary

On Linux, SslStream previously closed the transport without sending a TLS alert when certificate validation failed. This PR makes SslStream send appropriate TLS alerts (e.g. bad_certificate, unknown_ca, certificate_expired, certificate_required) by moving certificate validation inline into the OpenSSL handshake via SSL_CTX_set_cert_verify_cb.

How it works

Instead of validating the peer certificate after the handshake completes (post-handshake), the validation now runs inside OpenSSL's certificate verification callback during the handshake itself. This allows OpenSSL to send the appropriate TLS alert to the peer when validation fails, since the handshake is still in progress.

The CertVerifyCallback (registered on the SSL_CTX) extracts the certificate chain from the X509_STORE_CTX, then calls the existing managed VerifyRemoteCertificate logic — including the user's RemoteCertificateValidationCallback if one is registered. If validation fails, the callback maps the failure reason to an X509_V_ERR_* status code, which OpenSSL translates into the corresponding TLS alert.

Connection info during the callback

Because the callback fires mid-handshake, connection properties like SslProtocol and CipherAlgorithm would normally not be available yet. To preserve backward compatibility with user callbacks that access these properties, _connectionInfo is populated before invoking the user callback. On TLS 1.2, SSL_get_current_cipher() returns NULL at this point (the session cipher is set at ChangeCipherSpec), so the native code falls back to SSL_get_pending_cipher() which is available once ServerHello has been processed.

Propagating exceptions from validation callback

The exception that would normally be thrown from the cert validation (either AuthenticationException, or whatever user code throws) is caught and stored in SafeSslHandle before returning back to OpenSSL code, and when the control flow returns from SSL_do_handshake, the exception gets rethrown.

Client certificates and `ClientCertificateRequired`

OpenSSL only invokes the cert verify callback when the peer actually sends a certificate. When a server sets ClientCertificateRequired = true but the client sends no certificate, the callback never fires. Two cases are handled:

No user callback registered:SSL_VERIFY_FAIL_IF_NO_PEER_CERT is set alongside SSL_VERIFY_PEER, so OpenSSL itself rejects the handshake and sends the certificate_required (TLS 1.3) or handshake_failure (TLS 1.2) alert.
User callback registered: Only SSL_VERIFY_PEER is set. The handshake succeeds, and managed CompleteHandshake code detects that _remoteCertificate is still null, then calls VerifyRemoteCertificate which invokes the user's callback with SslPolicyErrors.RemoteCertificateNotAvailable. This preserves the existing behavior where applications can accept connections without a client certificate via the callback, unfortunately, no TLS alert is sent in this case.

Resumed sessions

On resumed sessions, OpenSSL skips the cert verify callback since the certificate was already validated in the original handshake. CompleteHandshake detects this (_remoteCertificate is null) and retrieves the peer certificate from the SSL handle via GetRemoteCertificate and valites it post-handshake, previous behavior is preserved (no TLS alert is sent if revalidation fails, but this is not expected to happen often in practice).

dotnet-policy-service · 2025-05-26T13:38:46Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Fixesdotnet#18837

dotnet-policy-service · 2025-08-01T03:28:16Z

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

liveans

LGTM

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

rzikm · 2026-04-15T08:24:01Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2026-04-15T08:24:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

rzikm · 2025-05-26T13:37:46Z

Contributes to #18837.

Summary

On Linux, SslStream previously closed the transport without sending a TLS alert when certificate validation failed. This PR makes SslStream send appropriate TLS alerts (e.g. bad_certificate, unknown_ca, certificate_expired, certificate_required) by moving certificate validation inline into the OpenSSL handshake via SSL_CTX_set_cert_verify_cb.

How it works

Instead of validating the peer certificate after the handshake completes (post-handshake), the validation now runs inside OpenSSL's certificate verification callback during the handshake itself. This allows OpenSSL to send the appropriate TLS alert to the peer when validation fails, since the handshake is still in progress.

The CertVerifyCallback (registered on the SSL_CTX) extracts the certificate chain from the X509_STORE_CTX, then calls the existing managed VerifyRemoteCertificate logic — including the user's RemoteCertificateValidationCallback if one is registered. If validation fails, the callback maps the failure reason to an X509_V_ERR_* status code, which OpenSSL translates into the corresponding TLS alert.

Connection info during the callback

Because the callback fires mid-handshake, connection properties like SslProtocol and CipherAlgorithm would normally not be available yet. To preserve backward compatibility with user callbacks that access these properties, _connectionInfo is populated before invoking the user callback. On TLS 1.2, SSL_get_current_cipher() returns NULL at this point (the session cipher is set at ChangeCipherSpec), so the native code falls back to SSL_get_pending_cipher() which is available once ServerHello has been processed.

Propagating exceptions from validation callback

The exception that would normally be thrown from the cert validation (either AuthenticationException, or whatever user code throws) is caught and stored in SafeSslHandle before returning back to OpenSSL code, and when the control flow returns from SSL_do_handshake, the exception gets rethrown.

Client certificates and `ClientCertificateRequired`

OpenSSL only invokes the cert verify callback when the peer actually sends a certificate. When a server sets ClientCertificateRequired = true but the client sends no certificate, the callback never fires. Two cases are handled:

No user callback registered:SSL_VERIFY_FAIL_IF_NO_PEER_CERT is set alongside SSL_VERIFY_PEER, so OpenSSL itself rejects the handshake and sends the certificate_required (TLS 1.3) or handshake_failure (TLS 1.2) alert.
User callback registered: Only SSL_VERIFY_PEER is set. The handshake succeeds, and managed CompleteHandshake code detects that _remoteCertificate is still null, then calls VerifyRemoteCertificate which invokes the user's callback with SslPolicyErrors.RemoteCertificateNotAvailable. This preserves the existing behavior where applications can accept connections without a client certificate via the callback, unfortunately, no TLS alert is sent in this case.

Resumed sessions

On resumed sessions, OpenSSL skips the cert verify callback since the certificate was already validated in the original handshake. CompleteHandshake detects this (_remoteCertificate is null) and retrieves the peer certificate from the SSL handle via GetRemoteCertificate and valites it post-handshake, previous behavior is preserved (no TLS alert is sent if revalidation fails, but this is not expected to happen often in practice).

dotnet-policy-service · 2025-05-26T13:38:46Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Fixesdotnet#18837

dotnet-policy-service · 2025-08-01T03:28:16Z

Draft Pull Request was automatically closed for 30 days of inactivity. Please let us know if you'd like to reopen it.

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

liveans

LGTM

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

rzikm · 2026-04-15T08:24:01Z

/azp run runtime-libraries-coreclr outerloop

azure-pipelines · 2026-04-15T08:24:19Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

github-actionsBot added the area-System.Net.Security label May 26, 2025

dotnet-policy-serviceBot assigned rzikm May 26, 2025

rzikm changed the title ~~Implement certificate verification callback and related enhancements~~[WIP] Support certificate validation for TLS alerts for LinuxMay 26, 2025

Dirty WIP
b6fb762

rzikm added 2 commits June 4, 2025 09:28

WIP
b84be9d

Supports TLS alerts for cert validation for non-Windows platforms
6450c19
Fixesdotnet#18837

rzikm force-pushed the 18837-Supports-TLS-alerts-for-cert-validation-for-non-Windows-platforms branch from a4c4177 to 6450c19Compare June 16, 2025 11:27

rzikm added 3 commits June 24, 2025 15:13

revert unneeded change
e4e866a

WIP
d5568d0

Reuse cert validation code
8960d45

rzikm changed the title ~~[WIP] Support certificate validation for TLS alerts for Linux~~[WIP] Support certificate validation TLS alerts for LinuxJul 1, 2025

Propagate validation exception back to managed code
7cb0edd

This was referenced Jul 1, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed

dotnet-policy-serviceBot closed this Aug 1, 2025

github-actionsBot locked and limited conversation to collaborators Aug 31, 2025

rzikm reopened this Mar 2, 2026

build-analysisBot mentioned this pull request Apr 14, 2026
XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796
Open

Copilotstarted reviewing on behalf of rzikm April 14, 2026 12:04 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated

Improve exception tests on Linux
3930e70

liveans approved these changes Apr 14, 2026
View reviewed changes

Improve certificate lifetime
5399b66

CopilotAI review requested due to automatic review settings April 14, 2026 13:50

Copilotstarted reviewing on behalf of rzikm April 14, 2026 13:51 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

Use weak handle to point SslSafeHandle->SslAuthenticationOptions.
0df8c6b

Fix OCSP Stapling
7627477

CopilotAI review requested due to automatic review settings April 15, 2026 15:05

Copilotstarted reviewing on behalf of rzikm April 15, 2026 15:06 View session

CopilotAI reviewed Apr 15, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

build-analysisBot mentioned this pull request Apr 15, 2026
Android arm32 device not found (armeabi-v7a architecture unavailable) #125440
Closed

bartonjs reviewed Apr 15, 2026
View reviewed changes

rzikm added 2 commits April 16, 2026 14:34

Code review feedback
764379f

Use ActiveIssue to restrict where tests run
4bd8453

CopilotAI review requested due to automatic review settings April 16, 2026 14:46

Copilotstarted reviewing on behalf of rzikm April 16, 2026 14:47 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs

Minor fix
0adecba

This was referenced Apr 16, 2026
[browser] Could not resolve type with token 01000001 from typeref #126997
Open
Libraries .NET 4.8.1 build failing #127007
Closed

rzikm merged commit 6a04342 into dotnet:mainApr 17, 2026
106 of 112 checks passed

MihuBot mentioned this pull request Apr 17, 2026
[✨ Triage] dotnet/runtime#127053 by rzikm - Support certificate validation TLS Alerts for OSX MihuBot/dotnet-triage#199
Open

dotnet-maestroBot mentioned this pull request Apr 18, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6098
Merged

github-actionsBot locked and limited conversation to collaborators May 17, 2026

github-actionsBot added the area-System.Net.Security label May 26, 2025

dotnet-policy-serviceBot assigned rzikm May 26, 2025

rzikm changed the title ~~Implement certificate verification callback and related enhancements~~[WIP] Support certificate validation for TLS alerts for LinuxMay 26, 2025

Dirty WIP
b6fb762

rzikm added 2 commits June 4, 2025 09:28

WIP
b84be9d

Supports TLS alerts for cert validation for non-Windows platforms
6450c19
Fixesdotnet#18837

rzikm force-pushed the 18837-Supports-TLS-alerts-for-cert-validation-for-non-Windows-platforms branch from a4c4177 to 6450c19Compare June 16, 2025 11:27

rzikm added 3 commits June 24, 2025 15:13

revert unneeded change
e4e866a

WIP
d5568d0

Reuse cert validation code
8960d45

rzikm changed the title ~~[WIP] Support certificate validation for TLS alerts for Linux~~[WIP] Support certificate validation TLS alerts for LinuxJul 1, 2025

Propagate validation exception back to managed code
7cb0edd

This was referenced Jul 1, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed

dotnet-policy-serviceBot closed this Aug 1, 2025

github-actionsBot locked and limited conversation to collaborators Aug 31, 2025

rzikm reopened this Mar 2, 2026

build-analysisBot mentioned this pull request Apr 14, 2026
XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796
Open

Copilotstarted reviewing on behalf of rzikm April 14, 2026 12:04 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated

Improve exception tests on Linux
3930e70

liveans approved these changes Apr 14, 2026
View reviewed changes

Improve certificate lifetime
5399b66

CopilotAI review requested due to automatic review settings April 14, 2026 13:50

Copilotstarted reviewing on behalf of rzikm April 14, 2026 13:51 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

Use weak handle to point SslSafeHandle->SslAuthenticationOptions.
0df8c6b

Fix OCSP Stapling
7627477

CopilotAI review requested due to automatic review settings April 15, 2026 15:05

Copilotstarted reviewing on behalf of rzikm April 15, 2026 15:06 View session

CopilotAI reviewed Apr 15, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

build-analysisBot mentioned this pull request Apr 15, 2026
Android arm32 device not found (armeabi-v7a architecture unavailable) #125440
Closed

bartonjs reviewed Apr 15, 2026
View reviewed changes

rzikm added 2 commits April 16, 2026 14:34

Code review feedback
764379f

Use ActiveIssue to restrict where tests run
4bd8453

CopilotAI review requested due to automatic review settings April 16, 2026 14:46

Copilotstarted reviewing on behalf of rzikm April 16, 2026 14:47 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs

Minor fix
0adecba

This was referenced Apr 16, 2026
[browser] Could not resolve type with token 01000001 from typeref #126997
Open
Libraries .NET 4.8.1 build failing #127007
Closed

rzikm merged commit 6a04342 into dotnet:mainApr 17, 2026
106 of 112 checks passed

MihuBot mentioned this pull request Apr 17, 2026
[✨ Triage] dotnet/runtime#127053 by rzikm - Support certificate validation TLS Alerts for OSX MihuBot/dotnet-triage#199
Open

dotnet-maestroBot mentioned this pull request Apr 18, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6098
Merged

github-actionsBot locked and limited conversation to collaborators May 17, 2026

github-actionsBot added the area-System.Net.Security label May 26, 2025

dotnet-policy-serviceBot assigned rzikm May 26, 2025

rzikm changed the title ~~Implement certificate verification callback and related enhancements~~[WIP] Support certificate validation for TLS alerts for LinuxMay 26, 2025

Dirty WIP
b6fb762

rzikm added 2 commits June 4, 2025 09:28

WIP
b84be9d

Supports TLS alerts for cert validation for non-Windows platforms
6450c19
Fixesdotnet#18837

rzikm force-pushed the 18837-Supports-TLS-alerts-for-cert-validation-for-non-Windows-platforms branch from a4c4177 to 6450c19Compare June 16, 2025 11:27

rzikm added 3 commits June 24, 2025 15:13

revert unneeded change
e4e866a

WIP
d5568d0

Reuse cert validation code
8960d45

rzikm changed the title ~~[WIP] Support certificate validation for TLS alerts for Linux~~[WIP] Support certificate validation TLS alerts for LinuxJul 1, 2025

Propagate validation exception back to managed code
7cb0edd

This was referenced Jul 1, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed

dotnet-policy-serviceBot closed this Aug 1, 2025

github-actionsBot locked and limited conversation to collaborators Aug 31, 2025

rzikm reopened this Mar 2, 2026

build-analysisBot mentioned this pull request Apr 14, 2026
XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796
Open

Copilotstarted reviewing on behalf of rzikm April 14, 2026 12:04 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated

Improve exception tests on Linux
3930e70

liveans approved these changes Apr 14, 2026
View reviewed changes

Improve certificate lifetime
5399b66

CopilotAI review requested due to automatic review settings April 14, 2026 13:50

Copilotstarted reviewing on behalf of rzikm April 14, 2026 13:51 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

Use weak handle to point SslSafeHandle->SslAuthenticationOptions.
0df8c6b

Fix OCSP Stapling
7627477

CopilotAI review requested due to automatic review settings April 15, 2026 15:05

Copilotstarted reviewing on behalf of rzikm April 15, 2026 15:06 View session

CopilotAI reviewed Apr 15, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

build-analysisBot mentioned this pull request Apr 15, 2026
Android arm32 device not found (armeabi-v7a architecture unavailable) #125440
Closed

bartonjs reviewed Apr 15, 2026
View reviewed changes

rzikm added 2 commits April 16, 2026 14:34

Code review feedback
764379f

Use ActiveIssue to restrict where tests run
4bd8453

CopilotAI review requested due to automatic review settings April 16, 2026 14:46

Copilotstarted reviewing on behalf of rzikm April 16, 2026 14:47 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs

Minor fix
0adecba

This was referenced Apr 16, 2026
[browser] Could not resolve type with token 01000001 from typeref #126997
Open
Libraries .NET 4.8.1 build failing #127007
Closed

rzikm merged commit 6a04342 into dotnet:mainApr 17, 2026
106 of 112 checks passed

MihuBot mentioned this pull request Apr 17, 2026
[✨ Triage] dotnet/runtime#127053 by rzikm - Support certificate validation TLS Alerts for OSX MihuBot/dotnet-triage#199
Open

dotnet-maestroBot mentioned this pull request Apr 18, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6098
Merged

github-actionsBot locked and limited conversation to collaborators May 17, 2026

github-actionsBot added the area-System.Net.Security label May 26, 2025

dotnet-policy-serviceBot assigned rzikm May 26, 2025

rzikm changed the title ~~Implement certificate verification callback and related enhancements~~[WIP] Support certificate validation for TLS alerts for LinuxMay 26, 2025

Dirty WIP
b6fb762

rzikm added 2 commits June 4, 2025 09:28

WIP
b84be9d

Supports TLS alerts for cert validation for non-Windows platforms
6450c19
Fixesdotnet#18837

rzikm force-pushed the 18837-Supports-TLS-alerts-for-cert-validation-for-non-Windows-platforms branch from a4c4177 to 6450c19Compare June 16, 2025 11:27

rzikm added 3 commits June 24, 2025 15:13

revert unneeded change
e4e866a

WIP
d5568d0

Reuse cert validation code
8960d45

rzikm changed the title ~~[WIP] Support certificate validation for TLS alerts for Linux~~[WIP] Support certificate validation TLS alerts for LinuxJul 1, 2025

Propagate validation exception back to managed code
7cb0edd

This was referenced Jul 1, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed

dotnet-policy-serviceBot closed this Aug 1, 2025

github-actionsBot locked and limited conversation to collaborators Aug 31, 2025

rzikm reopened this Mar 2, 2026

build-analysisBot mentioned this pull request Apr 14, 2026
XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796
Open

Copilotstarted reviewing on behalf of rzikm April 14, 2026 12:04 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated

Improve exception tests on Linux
3930e70

liveans approved these changes Apr 14, 2026
View reviewed changes

Improve certificate lifetime
5399b66

CopilotAI review requested due to automatic review settings April 14, 2026 13:50

Copilotstarted reviewing on behalf of rzikm April 14, 2026 13:51 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

Use weak handle to point SslSafeHandle->SslAuthenticationOptions.
0df8c6b

Fix OCSP Stapling
7627477

CopilotAI review requested due to automatic review settings April 15, 2026 15:05

Copilotstarted reviewing on behalf of rzikm April 15, 2026 15:06 View session

CopilotAI reviewed Apr 15, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

build-analysisBot mentioned this pull request Apr 15, 2026
Android arm32 device not found (armeabi-v7a architecture unavailable) #125440
Closed

bartonjs reviewed Apr 15, 2026
View reviewed changes

rzikm added 2 commits April 16, 2026 14:34

Code review feedback
764379f

Use ActiveIssue to restrict where tests run
4bd8453

CopilotAI review requested due to automatic review settings April 16, 2026 14:46

Copilotstarted reviewing on behalf of rzikm April 16, 2026 14:47 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs

Minor fix
0adecba

This was referenced Apr 16, 2026
[browser] Could not resolve type with token 01000001 from typeref #126997
Open
Libraries .NET 4.8.1 build failing #127007
Closed

rzikm merged commit 6a04342 into dotnet:mainApr 17, 2026
106 of 112 checks passed

MihuBot mentioned this pull request Apr 17, 2026
[✨ Triage] dotnet/runtime#127053 by rzikm - Support certificate validation TLS Alerts for OSX MihuBot/dotnet-triage#199
Open

dotnet-maestroBot mentioned this pull request Apr 18, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6098
Merged

github-actionsBot locked and limited conversation to collaborators May 17, 2026

github-actionsBot added the area-System.Net.Security label May 26, 2025

dotnet-policy-serviceBot assigned rzikm May 26, 2025

rzikm changed the title ~~Implement certificate verification callback and related enhancements~~[WIP] Support certificate validation for TLS alerts for LinuxMay 26, 2025

Dirty WIP
b6fb762

rzikm added 2 commits June 4, 2025 09:28

WIP
b84be9d

Supports TLS alerts for cert validation for non-Windows platforms
6450c19
Fixesdotnet#18837

rzikm force-pushed the 18837-Supports-TLS-alerts-for-cert-validation-for-non-Windows-platforms branch from a4c4177 to 6450c19Compare June 16, 2025 11:27

rzikm added 3 commits June 24, 2025 15:13

revert unneeded change
e4e866a

WIP
d5568d0

Reuse cert validation code
8960d45

rzikm changed the title ~~[WIP] Support certificate validation for TLS alerts for Linux~~[WIP] Support certificate validation TLS alerts for LinuxJul 1, 2025

Propagate validation exception back to managed code
7cb0edd

This was referenced Jul 1, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed

dotnet-policy-serviceBot closed this Aug 1, 2025

github-actionsBot locked and limited conversation to collaborators Aug 31, 2025

rzikm reopened this Mar 2, 2026

build-analysisBot mentioned this pull request Apr 14, 2026
XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796
Open

Copilotstarted reviewing on behalf of rzikm April 14, 2026 12:04 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated

Improve exception tests on Linux
3930e70

liveans approved these changes Apr 14, 2026
View reviewed changes

Improve certificate lifetime
5399b66

CopilotAI review requested due to automatic review settings April 14, 2026 13:50

Copilotstarted reviewing on behalf of rzikm April 14, 2026 13:51 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

Use weak handle to point SslSafeHandle->SslAuthenticationOptions.
0df8c6b

Fix OCSP Stapling
7627477

CopilotAI review requested due to automatic review settings April 15, 2026 15:05

Copilotstarted reviewing on behalf of rzikm April 15, 2026 15:06 View session

CopilotAI reviewed Apr 15, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

build-analysisBot mentioned this pull request Apr 15, 2026
Android arm32 device not found (armeabi-v7a architecture unavailable) #125440
Closed

bartonjs reviewed Apr 15, 2026
View reviewed changes

rzikm added 2 commits April 16, 2026 14:34

Code review feedback
764379f

Use ActiveIssue to restrict where tests run
4bd8453

CopilotAI review requested due to automatic review settings April 16, 2026 14:46

Copilotstarted reviewing on behalf of rzikm April 16, 2026 14:47 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs

Minor fix
0adecba

This was referenced Apr 16, 2026
[browser] Could not resolve type with token 01000001 from typeref #126997
Open
Libraries .NET 4.8.1 build failing #127007
Closed

rzikm merged commit 6a04342 into dotnet:mainApr 17, 2026
106 of 112 checks passed

MihuBot mentioned this pull request Apr 17, 2026
[✨ Triage] dotnet/runtime#127053 by rzikm - Support certificate validation TLS Alerts for OSX MihuBot/dotnet-triage#199
Open

dotnet-maestroBot mentioned this pull request Apr 18, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6098
Merged

github-actionsBot locked and limited conversation to collaborators May 17, 2026

github-actionsBot added the area-System.Net.Security label May 26, 2025

dotnet-policy-serviceBot assigned rzikm May 26, 2025

rzikm changed the title ~~Implement certificate verification callback and related enhancements~~[WIP] Support certificate validation for TLS alerts for LinuxMay 26, 2025

Dirty WIP
b6fb762

rzikm added 2 commits June 4, 2025 09:28

WIP
b84be9d

Supports TLS alerts for cert validation for non-Windows platforms
6450c19
Fixesdotnet#18837

rzikm force-pushed the 18837-Supports-TLS-alerts-for-cert-validation-for-non-Windows-platforms branch from a4c4177 to 6450c19Compare June 16, 2025 11:27

rzikm added 3 commits June 24, 2025 15:13

revert unneeded change
e4e866a

WIP
d5568d0

Reuse cert validation code
8960d45

rzikm changed the title ~~[WIP] Support certificate validation for TLS alerts for Linux~~[WIP] Support certificate validation TLS alerts for LinuxJul 1, 2025

Propagate validation exception back to managed code
7cb0edd

This was referenced Jul 1, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed

dotnet-policy-serviceBot closed this Aug 1, 2025

github-actionsBot locked and limited conversation to collaborators Aug 31, 2025

rzikm reopened this Mar 2, 2026

build-analysisBot mentioned this pull request Apr 14, 2026
XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796
Open

Copilotstarted reviewing on behalf of rzikm April 14, 2026 12:04 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated

Improve exception tests on Linux
3930e70

liveans approved these changes Apr 14, 2026
View reviewed changes

Improve certificate lifetime
5399b66

CopilotAI review requested due to automatic review settings April 14, 2026 13:50

Copilotstarted reviewing on behalf of rzikm April 14, 2026 13:51 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

Use weak handle to point SslSafeHandle->SslAuthenticationOptions.
0df8c6b

Fix OCSP Stapling
7627477

CopilotAI review requested due to automatic review settings April 15, 2026 15:05

Copilotstarted reviewing on behalf of rzikm April 15, 2026 15:06 View session

CopilotAI reviewed Apr 15, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

build-analysisBot mentioned this pull request Apr 15, 2026
Android arm32 device not found (armeabi-v7a architecture unavailable) #125440
Closed

bartonjs reviewed Apr 15, 2026
View reviewed changes

rzikm added 2 commits April 16, 2026 14:34

Code review feedback
764379f

Use ActiveIssue to restrict where tests run
4bd8453

CopilotAI review requested due to automatic review settings April 16, 2026 14:46

Copilotstarted reviewing on behalf of rzikm April 16, 2026 14:47 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs

Minor fix
0adecba

This was referenced Apr 16, 2026
[browser] Could not resolve type with token 01000001 from typeref #126997
Open
Libraries .NET 4.8.1 build failing #127007
Closed

rzikm merged commit 6a04342 into dotnet:mainApr 17, 2026
106 of 112 checks passed

MihuBot mentioned this pull request Apr 17, 2026
[✨ Triage] dotnet/runtime#127053 by rzikm - Support certificate validation TLS Alerts for OSX MihuBot/dotnet-triage#199
Open

dotnet-maestroBot mentioned this pull request Apr 18, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6098
Merged

github-actionsBot locked and limited conversation to collaborators May 17, 2026

github-actionsBot added the area-System.Net.Security label May 26, 2025

dotnet-policy-serviceBot assigned rzikm May 26, 2025

rzikm changed the title ~~Implement certificate verification callback and related enhancements~~[WIP] Support certificate validation for TLS alerts for LinuxMay 26, 2025

Dirty WIP
b6fb762

rzikm added 2 commits June 4, 2025 09:28

WIP
b84be9d

Supports TLS alerts for cert validation for non-Windows platforms
6450c19
Fixesdotnet#18837

rzikm force-pushed the 18837-Supports-TLS-alerts-for-cert-validation-for-non-Windows-platforms branch from a4c4177 to 6450c19Compare June 16, 2025 11:27

rzikm added 3 commits June 24, 2025 15:13

revert unneeded change
e4e866a

WIP
d5568d0

Reuse cert validation code
8960d45

rzikm changed the title ~~[WIP] Support certificate validation for TLS alerts for Linux~~[WIP] Support certificate validation TLS alerts for LinuxJul 1, 2025

Propagate validation exception back to managed code
7cb0edd

This was referenced Jul 1, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed

dotnet-policy-serviceBot closed this Aug 1, 2025

github-actionsBot locked and limited conversation to collaborators Aug 31, 2025

rzikm reopened this Mar 2, 2026

build-analysisBot mentioned this pull request Apr 14, 2026
XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796
Open

Copilotstarted reviewing on behalf of rzikm April 14, 2026 12:04 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated

Improve exception tests on Linux
3930e70

liveans approved these changes Apr 14, 2026
View reviewed changes

Improve certificate lifetime
5399b66

CopilotAI review requested due to automatic review settings April 14, 2026 13:50

Copilotstarted reviewing on behalf of rzikm April 14, 2026 13:51 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

Use weak handle to point SslSafeHandle->SslAuthenticationOptions.
0df8c6b

Fix OCSP Stapling
7627477

CopilotAI review requested due to automatic review settings April 15, 2026 15:05

Copilotstarted reviewing on behalf of rzikm April 15, 2026 15:06 View session

CopilotAI reviewed Apr 15, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

build-analysisBot mentioned this pull request Apr 15, 2026
Android arm32 device not found (armeabi-v7a architecture unavailable) #125440
Closed

bartonjs reviewed Apr 15, 2026
View reviewed changes

rzikm added 2 commits April 16, 2026 14:34

Code review feedback
764379f

Use ActiveIssue to restrict where tests run
4bd8453

CopilotAI review requested due to automatic review settings April 16, 2026 14:46

Copilotstarted reviewing on behalf of rzikm April 16, 2026 14:47 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs

Minor fix
0adecba

This was referenced Apr 16, 2026
[browser] Could not resolve type with token 01000001 from typeref #126997
Open
Libraries .NET 4.8.1 build failing #127007
Closed

rzikm merged commit 6a04342 into dotnet:mainApr 17, 2026
106 of 112 checks passed

MihuBot mentioned this pull request Apr 17, 2026
[✨ Triage] dotnet/runtime#127053 by rzikm - Support certificate validation TLS Alerts for OSX MihuBot/dotnet-triage#199
Open

dotnet-maestroBot mentioned this pull request Apr 18, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6098
Merged

github-actionsBot locked and limited conversation to collaborators May 17, 2026

github-actionsBot added the area-System.Net.Security label May 26, 2025

dotnet-policy-serviceBot assigned rzikm May 26, 2025

rzikm changed the title ~~Implement certificate verification callback and related enhancements~~[WIP] Support certificate validation for TLS alerts for LinuxMay 26, 2025

Dirty WIP
b6fb762

rzikm added 2 commits June 4, 2025 09:28

WIP
b84be9d

Supports TLS alerts for cert validation for non-Windows platforms
6450c19
Fixesdotnet#18837

rzikm force-pushed the 18837-Supports-TLS-alerts-for-cert-validation-for-non-Windows-platforms branch from a4c4177 to 6450c19Compare June 16, 2025 11:27

rzikm added 3 commits June 24, 2025 15:13

revert unneeded change
e4e866a

WIP
d5568d0

Reuse cert validation code
8960d45

rzikm changed the title ~~[WIP] Support certificate validation for TLS alerts for Linux~~[WIP] Support certificate validation TLS alerts for LinuxJul 1, 2025

Propagate validation exception back to managed code
7cb0edd

This was referenced Jul 1, 2025
browser-wasm Windows build error #116746
Closed
wasm build failure in CI #117017
Closed

dotnet-policy-serviceBot closed this Aug 1, 2025

github-actionsBot locked and limited conversation to collaborators Aug 31, 2025

rzikm reopened this Mar 2, 2026

build-analysisBot mentioned this pull request Apr 14, 2026
XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796
Open

Copilotstarted reviewing on behalf of rzikm April 14, 2026 12:04 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated

Improve exception tests on Linux
3930e70

liveans approved these changes Apr 14, 2026
View reviewed changes

Improve certificate lifetime
5399b66

CopilotAI review requested due to automatic review settings April 14, 2026 13:50

Copilotstarted reviewing on behalf of rzikm April 14, 2026 13:51 View session

CopilotAI reviewed Apr 14, 2026
View reviewed changes

Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

Use weak handle to point SslSafeHandle->SslAuthenticationOptions.
0df8c6b

Fix OCSP Stapling
7627477

CopilotAI review requested due to automatic review settings April 15, 2026 15:05

Copilotstarted reviewing on behalf of rzikm April 15, 2026 15:06 View session

CopilotAI reviewed Apr 15, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated

build-analysisBot mentioned this pull request Apr 15, 2026
Android arm32 device not found (armeabi-v7a architecture unavailable) #125440
Closed

bartonjs reviewed Apr 15, 2026
View reviewed changes

rzikm added 2 commits April 16, 2026 14:34

Code review feedback
764379f

Use ActiveIssue to restrict where tests run
4bd8453

CopilotAI review requested due to automatic review settings April 16, 2026 14:46

Copilotstarted reviewing on behalf of rzikm April 16, 2026 14:47 View session

CopilotAI reviewed Apr 16, 2026
View reviewed changes

Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs Outdated
Comment threadsrc/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.OpenSsl.cs

Minor fix
0adecba

This was referenced Apr 16, 2026
[browser] Could not resolve type with token 01000001 from typeref #126997
Open
Libraries .NET 4.8.1 build failing #127007
Closed

rzikm merged commit 6a04342 into dotnet:mainApr 17, 2026
106 of 112 checks passed

MihuBot mentioned this pull request Apr 17, 2026
[✨ Triage] dotnet/runtime#127053 by rzikm - Support certificate validation TLS Alerts for OSX MihuBot/dotnet-triage#199
Open

dotnet-maestroBot mentioned this pull request Apr 18, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#6098
Merged

github-actionsBot locked and limited conversation to collaborators May 17, 2026

Uh oh!

Conversation

rzikm commented May 26, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How it works

Connection info during the callback

Propagating exceptions from validation callback

Client certificates and ClientCertificateRequired

Resumed sessions

Uh oh!

dotnet-policy-serviceBot commented May 26, 2025

Uh oh!

dotnet-policy-serviceBot commented Aug 1, 2025

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

liveans left a comment

Choose a reason for hiding this comment

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

rzikm commented Apr 15, 2026

Uh oh!

azure-pipelinesBot commented Apr 15, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

rzikm commented May 26, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How it works

Connection info during the callback

Propagating exceptions from validation callback

Client certificates and ClientCertificateRequired

Resumed sessions

Uh oh!

dotnet-policy-serviceBot commented May 26, 2025

Uh oh!

dotnet-policy-serviceBot commented Aug 1, 2025

Uh oh!

CopilotAI left a comment

rzikm commented May 26, 2025•
edited
Loading

Client certificates and `ClientCertificateRequired`

rzikm commented May 26, 2025•
edited
Loading

Client certificates and `ClientCertificateRequired`

rzikm commented May 26, 2025•
edited
Loading

Client certificates and `ClientCertificateRequired`