Ignore the DuplicateExtension status from macOS 12.

[vcsjones]

MacOS 12 introduces a new X.509 chain status, DuplicateExtension. As we do not report this in Windows and nor do we have a flag to map it to, we ignore it from macOS.

The existing test TimestampTokenTests.TwoEkuExtensions covers this scenario.

Closes#58833.

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

MacOS 12 introduces a new X.509 chain status, DuplicateExtension. As we do not report this in Windows and nor do we have a flag to map it to, we ignore it from macOS.

An existing test in TimestampTokenTests.TwoEkuExtensions covers this scenario.

Author:	vcsjones
Assignees:	-
Labels:	area-System.Security, community-contribution
Milestone:	-

[danmoseley]

6.0 port I assume...

[vcsjones]

6.0 port I assume...

I don't have a strong feeling one way or the other, so I'll defer to the area owners. This is an edge case that I am 1. impressed there was test coverage for at all and 2. the certificate violates RFC 5280 section 4.2:

A certificate MUST NOT include more than one instance of a particular extension.

So, Apple is rightfully picky about a MUST. That said, because it is against the spec, I do not believe many certificates like this exist, certainly not a certificate issued by a public CA.

[bartonjs]

6.0 port I assume...

Yeah, I'll open the port PR. Mainly so that if/when we turn on macOS 12 testing in the 6.0 release branch we don't have a test failure.

[bartonjs]

/backport to release/6.0

[github-actions]

Started backporting to release/6.0: https://github.com/dotnet/runtime/actions/runs/1218282457