[release/11.0] Normalize X509Chain App/Cert policies across OSes - #132904

Merged
artl93 merged 1 commit into
release/11.0from
backport/pr-132348-to-release/11.0
Aug 28, 2026
Merged

[release/11.0] Normalize X509Chain App/Cert policies across OSes#132904
artl93 merged 1 commit into
release/11.0from
backport/pr-132348-to-release/11.0

Conversation

@github-actions

@github-actionsgithub-actionsBot commented Aug 28, 2026•
edited by bartonjs
Loading

Copy link
Copy Markdown
Contributor

Backport of #132348 to release/11.0

/cc @bartonjs

Customer Impact

  • Customer reported
  • Found internally

Users of the X509Chain API could encounter platform-specific differences regarding handling of the ChainPolicy.ApplicationPolicies and ChainPolicy.CertificatePolicies validators and their interaction with the ms-appPolicy, EKU, CertPolicy, and CertPolicyMapping extensions, leading to the chain to report a certificate suitable for usage on some systems while unsuitable for usage on others (both false-positives and false-negatives).

Some certificates gave a solid true/false on Windows, but caused exceptions on other platforms.

Regression

  • Yes
  • No

The managed certificate policy validator (which is trying to emulate Windows for .NET Framework compatibility) hasn't substantially changed since 2015.

Testing

How was the fix verified?

A whole lot of new tests are added in this change.

How was the issue missed previously?

The component was written before the CertificateRequest API was created, and at the time creating test certificates was a laborious process and involved checking in test cases.

What tests were added?

Many tests were added involving corrupt extensions, certificate policy mappings, any-policy and inhibit-any-policy, et cetera. These new tests are believed to be comprehensive for the area.

Risk

Low, due to the added test coverage.

@bartonjs
Normalize X509Chain App/Cert policies across OSes
bb266f0
The original policy handling code was written before contextual trust,
which made it hard to write good tests. Now that we have more tests,
unify the behaviors as best we can, even across invalidly encoded
extensions.
@azure-pipelines

azure-pipelinesBot commented Aug 28, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@bartonjs
bartonjs requested a review from artl93August 28, 2026 19:16
@dotnet-policy-service

dotnet-policy-serviceBot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

artl93
artl93 reviewed Aug 28, 2026
View reviewed changes

@artl93artl93 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious whether breaking change

Comment thread...Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePolicy.cs
@bartonjs

bartonjs commented Aug 28, 2026

Copy link
Copy Markdown
Member

curious whether breaking change

Not from an API impact sense. There are definitely some observable runtime differences, which is the point, so I'd be fine with writing a runtime/behavior breaking change for it... but the impact is largely around esoteric corner cases that don't appear in public certificate hierarchies (but could in private/enterprise).

@bartonjs

bartonjs commented Aug 28, 2026

Copy link
Copy Markdown
Member

/ba-g #132831

artl93
artl93 approved these changes Aug 28, 2026
View reviewed changes

@artl93artl93 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Your call on the doc.

@artl93artl93 added the Servicing-approved Approved for servicing release label Aug 28, 2026
This was referenced Aug 28, 2026
Open
Open
@artl93
artl93 merged commit 43ccfd7 into release/11.0Aug 28, 2026
86 of 89 checks passed
@artl93
artl93 deleted the backport/pr-132348-to-release/11.0 branch August 28, 2026 23:06
@dotnet-maestrodotnet-maestroBot mentioned this pull request Aug 28, 2026
Merged
@dotnet-milestone-botdotnet-milestone-botBot added this to the 11.0-rc2 milestone Aug 29, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bartonjsbartonjsbartonjs left review comments
@artl93artl93artl93 approved these changes

Assignees

No one assigned

Labels

area-System.SecurityServicing-approvedApproved for servicing release

Projects

None yet

Milestone

11.0-rc2

Development

Successfully merging this pull request may close these issues.

2 participants

@bartonjs@artl93
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
[release/11.0] Normalize X509Chain App/Cert policies across OSes - #132904
Merged
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Aug 28, 2026
Merged
[release/11.0] Normalize X509Chain App/Cert policies across OSes#132904
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Aug 28, 2026•

edited by bartonjs

Loading

Copy link


Copy Markdown

Contributor
Backport of #132348 to release/11.0
/cc @bartonjs
Customer Impact
  •  Customer reported
  •  Found internally
Users of the X509Chain API could encounter platform-specific differences regarding handling of the ChainPolicy.ApplicationPolicies and ChainPolicy.CertificatePolicies validators and their interaction with the ms-appPolicy, EKU, CertPolicy, and CertPolicyMapping extensions, leading to the chain to report a certificate suitable for usage on some systems while unsuitable for usage on others (both false-positives and false-negatives).
Some certificates gave a solid true/false on Windows, but caused exceptions on other platforms.
Regression
  •  Yes
  •  No
The managed certificate policy validator (which is trying to emulate Windows for .NET Framework compatibility) hasn't substantially changed since 2015.
Testing
How was the fix verified?
A whole lot of new tests are added in this change.
How was the issue missed previously?
The component was written before the CertificateRequest API was created, and at the time creating test certificates was a laborious process and involved checking in test cases.
What tests were added?
Many tests were added involving corrupt extensions, certificate policy mappings, any-policy and inhibit-any-policy, et cetera. These new tests are believed to be comprehensive for the area.
Risk
Low, due to the added test coverage.
@bartonjs
Normalize X509Chain App/Cert policies across OSes
bb266f0
The original policy handling code was written before contextual trust,
which made it hard to write good tests. Now that we have more tests,
unify the behaviors as best we can, even across invalidly encoded
extensions.
@azure-pipelines
azure-pipelinesBot
commented
Aug 28, 2026

Copy link


Copy Markdown


Azure Pipelines:

Successfully started running 3 pipeline(s).

13 pipeline(s) were filtered out due to trigger conditions.

There may be pipelines that require an authorized user to comment /azp run to run.
@bartonjs
bartonjs
requested a review
from artl93August 28, 2026 19:16
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security

See info in area-owners.md if you want to be subscribed.
artl93
artl93
reviewed
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious whether breaking change
Comment thread...Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePolicy.cs
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
curious whether breaking change
Not from an API impact sense. There are definitely some observable runtime differences, which is the point, so I'd be fine with writing a runtime/behavior breaking change for it... but the impact is largely around esoteric corner cases that don't appear in public certificate hierarchies (but could in private/enterprise).
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
/ba-g #132831
artl93
artl93
approved these changes
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Your call on the doc.
@artl93artl93
added
the 
Servicing-approved
Approved for servicing release
label
Aug 28, 2026

This was referenced Aug 28, 2026

Open


Open

@artl93
artl93
merged commit 43ccfd7
into
release/11.0Aug 28, 2026

86 of 89 checks passed

@artl93
artl93
deleted the

backport/pr-132348-to-release/11.0

branch
August 28, 2026 23:06
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Aug 28, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-rc2 milestone
Aug 29, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bartonjsbartonjsbartonjs left review comments
@artl93artl93artl93 approved these changes

Assignees


No one assigned


Labels

area-System.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

11.0-rc2

Development

Successfully merging this pull request may close these issues.

2 participants

@bartonjs@artl93

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/11.0] Normalize X509Chain App/Cert policies across OSes - #132904
Merged
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Aug 28, 2026
Merged
[release/11.0] Normalize X509Chain App/Cert policies across OSes#132904
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Aug 28, 2026•

edited by bartonjs

Loading

Copy link


Copy Markdown

Contributor
Backport of #132348 to release/11.0
/cc @bartonjs
Customer Impact
  •  Customer reported
  •  Found internally
Users of the X509Chain API could encounter platform-specific differences regarding handling of the ChainPolicy.ApplicationPolicies and ChainPolicy.CertificatePolicies validators and their interaction with the ms-appPolicy, EKU, CertPolicy, and CertPolicyMapping extensions, leading to the chain to report a certificate suitable for usage on some systems while unsuitable for usage on others (both false-positives and false-negatives).
Some certificates gave a solid true/false on Windows, but caused exceptions on other platforms.
Regression
  •  Yes
  •  No
The managed certificate policy validator (which is trying to emulate Windows for .NET Framework compatibility) hasn't substantially changed since 2015.
Testing
How was the fix verified?
A whole lot of new tests are added in this change.
How was the issue missed previously?
The component was written before the CertificateRequest API was created, and at the time creating test certificates was a laborious process and involved checking in test cases.
What tests were added?
Many tests were added involving corrupt extensions, certificate policy mappings, any-policy and inhibit-any-policy, et cetera. These new tests are believed to be comprehensive for the area.
Risk
Low, due to the added test coverage.
@bartonjs
Normalize X509Chain App/Cert policies across OSes
bb266f0
The original policy handling code was written before contextual trust,
which made it hard to write good tests. Now that we have more tests,
unify the behaviors as best we can, even across invalidly encoded
extensions.
@azure-pipelines
azure-pipelinesBot
commented
Aug 28, 2026

Copy link


Copy Markdown


Azure Pipelines:

Successfully started running 3 pipeline(s).

13 pipeline(s) were filtered out due to trigger conditions.

There may be pipelines that require an authorized user to comment /azp run to run.
@bartonjs
bartonjs
requested a review
from artl93August 28, 2026 19:16
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security

See info in area-owners.md if you want to be subscribed.
artl93
artl93
reviewed
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious whether breaking change
Comment thread...Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePolicy.cs
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
curious whether breaking change
Not from an API impact sense. There are definitely some observable runtime differences, which is the point, so I'd be fine with writing a runtime/behavior breaking change for it... but the impact is largely around esoteric corner cases that don't appear in public certificate hierarchies (but could in private/enterprise).
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
/ba-g #132831
artl93
artl93
approved these changes
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Your call on the doc.
@artl93artl93
added
the 
Servicing-approved
Approved for servicing release
label
Aug 28, 2026

This was referenced Aug 28, 2026

Open


Open

@artl93
artl93
merged commit 43ccfd7
into
release/11.0Aug 28, 2026

86 of 89 checks passed

@artl93
artl93
deleted the

backport/pr-132348-to-release/11.0

branch
August 28, 2026 23:06
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Aug 28, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-rc2 milestone
Aug 29, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bartonjsbartonjsbartonjs left review comments
@artl93artl93artl93 approved these changes

Assignees


No one assigned


Labels

area-System.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

11.0-rc2

Development

Successfully merging this pull request may close these issues.

2 participants

@bartonjs@artl93

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/11.0] Normalize X509Chain App/Cert policies across OSes - #132904
Merged
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Aug 28, 2026
Merged
[release/11.0] Normalize X509Chain App/Cert policies across OSes#132904
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Aug 28, 2026•

edited by bartonjs

Loading

Copy link


Copy Markdown

Contributor
Backport of #132348 to release/11.0
/cc @bartonjs
Customer Impact
  •  Customer reported
  •  Found internally
Users of the X509Chain API could encounter platform-specific differences regarding handling of the ChainPolicy.ApplicationPolicies and ChainPolicy.CertificatePolicies validators and their interaction with the ms-appPolicy, EKU, CertPolicy, and CertPolicyMapping extensions, leading to the chain to report a certificate suitable for usage on some systems while unsuitable for usage on others (both false-positives and false-negatives).
Some certificates gave a solid true/false on Windows, but caused exceptions on other platforms.
Regression
  •  Yes
  •  No
The managed certificate policy validator (which is trying to emulate Windows for .NET Framework compatibility) hasn't substantially changed since 2015.
Testing
How was the fix verified?
A whole lot of new tests are added in this change.
How was the issue missed previously?
The component was written before the CertificateRequest API was created, and at the time creating test certificates was a laborious process and involved checking in test cases.
What tests were added?
Many tests were added involving corrupt extensions, certificate policy mappings, any-policy and inhibit-any-policy, et cetera. These new tests are believed to be comprehensive for the area.
Risk
Low, due to the added test coverage.
@bartonjs
Normalize X509Chain App/Cert policies across OSes
bb266f0
The original policy handling code was written before contextual trust,
which made it hard to write good tests. Now that we have more tests,
unify the behaviors as best we can, even across invalidly encoded
extensions.
@azure-pipelines
azure-pipelinesBot
commented
Aug 28, 2026

Copy link


Copy Markdown


Azure Pipelines:

Successfully started running 3 pipeline(s).

13 pipeline(s) were filtered out due to trigger conditions.

There may be pipelines that require an authorized user to comment /azp run to run.
@bartonjs
bartonjs
requested a review
from artl93August 28, 2026 19:16
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security

See info in area-owners.md if you want to be subscribed.
artl93
artl93
reviewed
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious whether breaking change
Comment thread...Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePolicy.cs
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
curious whether breaking change
Not from an API impact sense. There are definitely some observable runtime differences, which is the point, so I'd be fine with writing a runtime/behavior breaking change for it... but the impact is largely around esoteric corner cases that don't appear in public certificate hierarchies (but could in private/enterprise).
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
/ba-g #132831
artl93
artl93
approved these changes
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Your call on the doc.
@artl93artl93
added
the 
Servicing-approved
Approved for servicing release
label
Aug 28, 2026

This was referenced Aug 28, 2026

Open


Open

@artl93
artl93
merged commit 43ccfd7
into
release/11.0Aug 28, 2026

86 of 89 checks passed

@artl93
artl93
deleted the

backport/pr-132348-to-release/11.0

branch
August 28, 2026 23:06
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Aug 28, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-rc2 milestone
Aug 29, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bartonjsbartonjsbartonjs left review comments
@artl93artl93artl93 approved these changes

Assignees


No one assigned


Labels

area-System.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

11.0-rc2

Development

Successfully merging this pull request may close these issues.

2 participants

@bartonjs@artl93

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
[release/11.0] Normalize X509Chain App/Cert policies across OSes - #132904
Merged
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Aug 28, 2026
Merged
[release/11.0] Normalize X509Chain App/Cert policies across OSes#132904
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Aug 28, 2026•

edited by bartonjs

Loading

Copy link


Copy Markdown

Contributor
Backport of #132348 to release/11.0
/cc @bartonjs
Customer Impact
  •  Customer reported
  •  Found internally
Users of the X509Chain API could encounter platform-specific differences regarding handling of the ChainPolicy.ApplicationPolicies and ChainPolicy.CertificatePolicies validators and their interaction with the ms-appPolicy, EKU, CertPolicy, and CertPolicyMapping extensions, leading to the chain to report a certificate suitable for usage on some systems while unsuitable for usage on others (both false-positives and false-negatives).
Some certificates gave a solid true/false on Windows, but caused exceptions on other platforms.
Regression
  •  Yes
  •  No
The managed certificate policy validator (which is trying to emulate Windows for .NET Framework compatibility) hasn't substantially changed since 2015.
Testing
How was the fix verified?
A whole lot of new tests are added in this change.
How was the issue missed previously?
The component was written before the CertificateRequest API was created, and at the time creating test certificates was a laborious process and involved checking in test cases.
What tests were added?
Many tests were added involving corrupt extensions, certificate policy mappings, any-policy and inhibit-any-policy, et cetera. These new tests are believed to be comprehensive for the area.
Risk
Low, due to the added test coverage.
@bartonjs
Normalize X509Chain App/Cert policies across OSes
bb266f0
The original policy handling code was written before contextual trust,
which made it hard to write good tests. Now that we have more tests,
unify the behaviors as best we can, even across invalidly encoded
extensions.
@azure-pipelines
azure-pipelinesBot
commented
Aug 28, 2026

Copy link


Copy Markdown


Azure Pipelines:

Successfully started running 3 pipeline(s).

13 pipeline(s) were filtered out due to trigger conditions.

There may be pipelines that require an authorized user to comment /azp run to run.
@bartonjs
bartonjs
requested a review
from artl93August 28, 2026 19:16
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security

See info in area-owners.md if you want to be subscribed.
artl93
artl93
reviewed
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious whether breaking change
Comment thread...Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePolicy.cs
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
curious whether breaking change
Not from an API impact sense. There are definitely some observable runtime differences, which is the point, so I'd be fine with writing a runtime/behavior breaking change for it... but the impact is largely around esoteric corner cases that don't appear in public certificate hierarchies (but could in private/enterprise).
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
/ba-g #132831
artl93
artl93
approved these changes
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Your call on the doc.
@artl93artl93
added
the 
Servicing-approved
Approved for servicing release
label
Aug 28, 2026

This was referenced Aug 28, 2026

Open


Open

@artl93
artl93
merged commit 43ccfd7
into
release/11.0Aug 28, 2026

86 of 89 checks passed

@artl93
artl93
deleted the

backport/pr-132348-to-release/11.0

branch
August 28, 2026 23:06
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Aug 28, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-rc2 milestone
Aug 29, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bartonjsbartonjsbartonjs left review comments
@artl93artl93artl93 approved these changes

Assignees


No one assigned


Labels

area-System.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

11.0-rc2

Development

Successfully merging this pull request may close these issues.

2 participants

@bartonjs@artl93

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/11.0] Normalize X509Chain App/Cert policies across OSes - #132904
Merged
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Aug 28, 2026
Merged
[release/11.0] Normalize X509Chain App/Cert policies across OSes#132904
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Aug 28, 2026•

edited by bartonjs

Loading

Copy link


Copy Markdown

Contributor
Backport of #132348 to release/11.0
/cc @bartonjs
Customer Impact
  •  Customer reported
  •  Found internally
Users of the X509Chain API could encounter platform-specific differences regarding handling of the ChainPolicy.ApplicationPolicies and ChainPolicy.CertificatePolicies validators and their interaction with the ms-appPolicy, EKU, CertPolicy, and CertPolicyMapping extensions, leading to the chain to report a certificate suitable for usage on some systems while unsuitable for usage on others (both false-positives and false-negatives).
Some certificates gave a solid true/false on Windows, but caused exceptions on other platforms.
Regression
  •  Yes
  •  No
The managed certificate policy validator (which is trying to emulate Windows for .NET Framework compatibility) hasn't substantially changed since 2015.
Testing
How was the fix verified?
A whole lot of new tests are added in this change.
How was the issue missed previously?
The component was written before the CertificateRequest API was created, and at the time creating test certificates was a laborious process and involved checking in test cases.
What tests were added?
Many tests were added involving corrupt extensions, certificate policy mappings, any-policy and inhibit-any-policy, et cetera. These new tests are believed to be comprehensive for the area.
Risk
Low, due to the added test coverage.
@bartonjs
Normalize X509Chain App/Cert policies across OSes
bb266f0
The original policy handling code was written before contextual trust,
which made it hard to write good tests. Now that we have more tests,
unify the behaviors as best we can, even across invalidly encoded
extensions.
@azure-pipelines
azure-pipelinesBot
commented
Aug 28, 2026

Copy link


Copy Markdown


Azure Pipelines:

Successfully started running 3 pipeline(s).

13 pipeline(s) were filtered out due to trigger conditions.

There may be pipelines that require an authorized user to comment /azp run to run.
@bartonjs
bartonjs
requested a review
from artl93August 28, 2026 19:16
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security

See info in area-owners.md if you want to be subscribed.
artl93
artl93
reviewed
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious whether breaking change
Comment thread...Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePolicy.cs
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
curious whether breaking change
Not from an API impact sense. There are definitely some observable runtime differences, which is the point, so I'd be fine with writing a runtime/behavior breaking change for it... but the impact is largely around esoteric corner cases that don't appear in public certificate hierarchies (but could in private/enterprise).
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
/ba-g #132831
artl93
artl93
approved these changes
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Your call on the doc.
@artl93artl93
added
the 
Servicing-approved
Approved for servicing release
label
Aug 28, 2026

This was referenced Aug 28, 2026

Open


Open

@artl93
artl93
merged commit 43ccfd7
into
release/11.0Aug 28, 2026

86 of 89 checks passed

@artl93
artl93
deleted the

backport/pr-132348-to-release/11.0

branch
August 28, 2026 23:06
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Aug 28, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-rc2 milestone
Aug 29, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bartonjsbartonjsbartonjs left review comments
@artl93artl93artl93 approved these changes

Assignees


No one assigned


Labels

area-System.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

11.0-rc2

Development

Successfully merging this pull request may close these issues.

2 participants

@bartonjs@artl93

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/11.0] Normalize X509Chain App/Cert policies across OSes - #132904
Merged
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Aug 28, 2026
Merged
[release/11.0] Normalize X509Chain App/Cert policies across OSes#132904
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Aug 28, 2026•

edited by bartonjs

Loading

Copy link


Copy Markdown

Contributor
Backport of #132348 to release/11.0
/cc @bartonjs
Customer Impact
  •  Customer reported
  •  Found internally
Users of the X509Chain API could encounter platform-specific differences regarding handling of the ChainPolicy.ApplicationPolicies and ChainPolicy.CertificatePolicies validators and their interaction with the ms-appPolicy, EKU, CertPolicy, and CertPolicyMapping extensions, leading to the chain to report a certificate suitable for usage on some systems while unsuitable for usage on others (both false-positives and false-negatives).
Some certificates gave a solid true/false on Windows, but caused exceptions on other platforms.
Regression
  •  Yes
  •  No
The managed certificate policy validator (which is trying to emulate Windows for .NET Framework compatibility) hasn't substantially changed since 2015.
Testing
How was the fix verified?
A whole lot of new tests are added in this change.
How was the issue missed previously?
The component was written before the CertificateRequest API was created, and at the time creating test certificates was a laborious process and involved checking in test cases.
What tests were added?
Many tests were added involving corrupt extensions, certificate policy mappings, any-policy and inhibit-any-policy, et cetera. These new tests are believed to be comprehensive for the area.
Risk
Low, due to the added test coverage.
@bartonjs
Normalize X509Chain App/Cert policies across OSes
bb266f0
The original policy handling code was written before contextual trust,
which made it hard to write good tests. Now that we have more tests,
unify the behaviors as best we can, even across invalidly encoded
extensions.
@azure-pipelines
azure-pipelinesBot
commented
Aug 28, 2026

Copy link


Copy Markdown


Azure Pipelines:

Successfully started running 3 pipeline(s).

13 pipeline(s) were filtered out due to trigger conditions.

There may be pipelines that require an authorized user to comment /azp run to run.
@bartonjs
bartonjs
requested a review
from artl93August 28, 2026 19:16
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security

See info in area-owners.md if you want to be subscribed.
artl93
artl93
reviewed
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious whether breaking change
Comment thread...Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePolicy.cs
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
curious whether breaking change
Not from an API impact sense. There are definitely some observable runtime differences, which is the point, so I'd be fine with writing a runtime/behavior breaking change for it... but the impact is largely around esoteric corner cases that don't appear in public certificate hierarchies (but could in private/enterprise).
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
/ba-g #132831
artl93
artl93
approved these changes
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Your call on the doc.
@artl93artl93
added
the 
Servicing-approved
Approved for servicing release
label
Aug 28, 2026

This was referenced Aug 28, 2026

Open


Open

@artl93
artl93
merged commit 43ccfd7
into
release/11.0Aug 28, 2026

86 of 89 checks passed

@artl93
artl93
deleted the

backport/pr-132348-to-release/11.0

branch
August 28, 2026 23:06
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Aug 28, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-rc2 milestone
Aug 29, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bartonjsbartonjsbartonjs left review comments
@artl93artl93artl93 approved these changes

Assignees


No one assigned


Labels

area-System.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

11.0-rc2

Development

Successfully merging this pull request may close these issues.

2 participants

@bartonjs@artl93

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
[release/11.0] Normalize X509Chain App/Cert policies across OSes - #132904
Merged
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Aug 28, 2026
Merged
[release/11.0] Normalize X509Chain App/Cert policies across OSes#132904
artl93 merged 1 commit into
release/11.0from 
backport/pr-132348-to-release/11.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Aug 28, 2026•

edited by bartonjs

Loading

Copy link


Copy Markdown

Contributor
Backport of #132348 to release/11.0
/cc @bartonjs
Customer Impact
  •  Customer reported
  •  Found internally
Users of the X509Chain API could encounter platform-specific differences regarding handling of the ChainPolicy.ApplicationPolicies and ChainPolicy.CertificatePolicies validators and their interaction with the ms-appPolicy, EKU, CertPolicy, and CertPolicyMapping extensions, leading to the chain to report a certificate suitable for usage on some systems while unsuitable for usage on others (both false-positives and false-negatives).
Some certificates gave a solid true/false on Windows, but caused exceptions on other platforms.
Regression
  •  Yes
  •  No
The managed certificate policy validator (which is trying to emulate Windows for .NET Framework compatibility) hasn't substantially changed since 2015.
Testing
How was the fix verified?
A whole lot of new tests are added in this change.
How was the issue missed previously?
The component was written before the CertificateRequest API was created, and at the time creating test certificates was a laborious process and involved checking in test cases.
What tests were added?
Many tests were added involving corrupt extensions, certificate policy mappings, any-policy and inhibit-any-policy, et cetera. These new tests are believed to be comprehensive for the area.
Risk
Low, due to the added test coverage.
@bartonjs
Normalize X509Chain App/Cert policies across OSes
bb266f0
The original policy handling code was written before contextual trust,
which made it hard to write good tests. Now that we have more tests,
unify the behaviors as best we can, even across invalidly encoded
extensions.
@azure-pipelines
azure-pipelinesBot
commented
Aug 28, 2026

Copy link


Copy Markdown


Azure Pipelines:

Successfully started running 3 pipeline(s).

13 pipeline(s) were filtered out due to trigger conditions.

There may be pipelines that require an authorized user to comment /azp run to run.
@bartonjs
bartonjs
requested a review
from artl93August 28, 2026 19:16
@dotnet-policy-service
dotnet-policy-serviceBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Contributor
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security

See info in area-owners.md if you want to be subscribed.
artl93
artl93
reviewed
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

curious whether breaking change
Comment thread...Security.Cryptography/src/System/Security/Cryptography/X509Certificates/CertificatePolicy.cs
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
curious whether breaking change
Not from an API impact sense. There are definitely some observable runtime differences, which is the point, so I'd be fine with writing a runtime/behavior breaking change for it... but the impact is largely around esoteric corner cases that don't appear in public certificate hierarchies (but could in private/enterprise).
@bartonjs
bartonjs
commented
Aug 28, 2026

Copy link


Copy Markdown

Member
/ba-g #132831
artl93
artl93
approved these changes
Aug 28, 2026
View reviewed changes
@artl93artl93
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Your call on the doc.
@artl93artl93
added
the 
Servicing-approved
Approved for servicing release
label
Aug 28, 2026

This was referenced Aug 28, 2026

Open


Open

@artl93
artl93
merged commit 43ccfd7
into
release/11.0Aug 28, 2026

86 of 89 checks passed

@artl93
artl93
deleted the

backport/pr-132348-to-release/11.0

branch
August 28, 2026 23:06
@dotnet-maestrodotnet-maestroBot
mentioned this pull request
Aug 28, 2026
 Merged

@dotnet-milestone-botdotnet-milestone-botBot
added this to the 11.0-rc2 milestone
Aug 29, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@bartonjsbartonjsbartonjs left review comments
@artl93artl93artl93 approved these changes

Assignees


No one assigned


Labels

area-System.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

11.0-rc2

Development

Successfully merging this pull request may close these issues.

2 participants

@bartonjs@artl93