[Android] SslStreamTls11NetworkConformanceTests fail with 'SslProtocols (Tls11) are not supported on this platform' despite ConditionalClass(SupportsTls11) skip

[ViveliDuCh]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1597620
Build error leg or test failing: net8.0-android-Release-arm64-Mono_Release / System.Net.Security.Tests.SslStreamTls11NetworkConformanceTests.*
Pull request: #133957 (release/8.0-staging -> release/8.0 merge; not introduced by this PR)

Console log: https://helixr1107v0xdeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-heads-release-80-staging-fd103e1897d64f92b0/System.Net.Security.Tests/1/console.b587e02c.log?helixlogtype=result

System.Security.Authentication.AuthenticationException : Authentication failed,
SslProtocols (Tls11) are not supported on this platform.

~32 test cases in the SslStreamTls11NetworkConformanceTests class fail. The class already has [ConditionalClass(typeof(PlatformDetection), nameof(PlatformDetection.SupportsTls11))] on both main and release/8.0-staging, meaning it should be skipped when the platform can't do TLS 1.1 but it's running (and failing at handshake) on this Android arm64 leg anyway.

Related but distinct: #119016 (closed, different test: System.Net.Http SslProtocols test, same underlying Android TLS1.1-unsupported theme).

Error Message

{
  "ErrorMessage": "SslProtocols (Tls11) are not supported on this platform.",
  "ErrorPattern": "SslStreamTls11NetworkConformanceTests",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1597620
Error message validated: [SslStreamTls11NetworkConformanceTests]
Result validation: ❌ Known issue did not match with the provided build.
Validation performed at: 9/15/2026 10:44:43 PM UTC

Report

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	0	0

[dotnet-policy-service]

Tagging subscribers to 'arch-android': @vitek-karas, @simonrozsival, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[steveisok]

We shouldn't run this on .net8

[wfurt]

Is it because Tls11 is no longer supported @steveisok ? I'm wondering if we should improve the compatibility detection somehow....

[steveisok]

@wfurt for mobile targets, .net 8 is long out of support.

[wfurt]

make sense. So the fix would be removing the android (and maybe more) from the queue list, right?