Generate TLS alerts on certificate validation failure on macOS by liveans · Pull Request #128316 · dotnet/runtime

liveans · 2026-05-18T10:31:59Z

Note

This pull request was prepared with AI assistance (GitHub Copilot CLI). The code, build, and test validation were performed by the assistant under my supervision.

Fixes #127053.

Summary

On macOS SecureTransport, when SslStream rejects the peer's certificate (chain build failure, name mismatch, missing cert, etc.) the handshake was aborted without putting a TLS alert on the wire — the peer just saw a
TCP RST / EOF. Windows / Linux / Android all send a fatal alert (unknown_ca, bad_certificate, …) per RFC 5246 §7.2 / RFC 8446 §6.2 before aborting. This PR brings macOS to parity.

Previous behavior (macOS, SecureTransport)

Step	Today
`errSSLServerAuthCompleted` / `errSSLClientAuthCompleted` from `SSLHandshake`	handled internally — no opportunity to inject an alert
`VerifyRemoteCertificate` fails in `CompleteHandshake`	exception is thrown, but no alert frame is emitted — peer sees a closed socket

New behavior

The Apple PAL now surfaces SecurityStatusPalErrorCode.CertValidationNeeded when SecureTransport pauses at the auth-completed state, before CompleteHandshake runs.
SslStream invokes its existing cert validation pipeline at that point and, on failure, builds a fatal alert record via TlsFrameHelper.CreateAlertFrame and writes it to the wire before tearing down the handshake.
The alert description follows the existing Windows/Linux mapping (GetAlertMessageFromChain for chain errors, BadCertificate for name mismatch, CertificateUnknown for missing cert).
The fallback is gated to SecureTransport (SafeDeleteSslContext) only — SafeDeleteNwContext (Network.framework, opt-in via System.Net.Security.UseNetworkFramework) keeps its async-context behavior untouched.

Design notes

Why an explicit plaintext alert frame?

AppleCryptoNative_SslSetError (new native shim around SSLSetError) sets SecureTransport's internal error state so subsequent SSLHandshake / SSLClose calls return the desired OSStatus — but empirical A/B testing
showed it does not itself write an alert record to the BIO. The PR therefore builds and writes the alert frame directly using TlsFrameHelper.CreateAlertFrame, which is the same code path Windows uses for
protocol_version alert injection. SSLSetError is still called so SecureTransport's internal state lines up with what we sent on the wire.

This is a SecureTransport-only behavior; Network.framework manages its own alert handling and is excluded via SslStreamPal.IsAsyncSecurityContext.

CanGenerateCustomAlertsForContext

CanGenerateCustomAlerts was a per-PAL const bool. It becomes a per-context method CanGenerateCustomAlertsForContext(SafeDeleteContext?) so the OSX PAL can answer true only for SafeDeleteSslContext. Windows /
Unix / Android keep the constant value as the implementation.

Cross-platform exception parity

VerifyRemoteCertificateAndGenerateNextToken initially surfaced the cert exception via SecurityStatusPalErrorCode.InternalError, which caused ForceAuthenticationAsync to wrap it inside
AuthenticationException(SR.net_auth_SSPI, …). On Windows / Linux / Android the cert exception is thrown directly by SendAuthResetSignal via ExceptionDispatchInfo.Throw. A new
SecurityStatusPalErrorCode.CertValidationFailed code is introduced; when the IO loop sees it, the inner cert exception is rethrown directly so the user-visible message matches the other platforms exactly. The new test
cases pin this behavior via Assert.Null(ex.InnerException) and message-content assertions.

Tests

New OSX-only functional tests in SslStreamAlertsTest:
- SslStream_NoCallback_UntrustedCert_SendsUnknownCAAlert_OSX — client side, server cert untrusted, asserts unknown_ca(48) reaches the server's recorded read stream.
- SslStream_NoCallback_UntrustedClientCert_ServerSendsUnknownCAAlert_OSX — server side, mutual-auth, asserts unknown_ca(48) reaches the client's recorded read stream.
- Both tests verify the actual on-the-wire bytes (via a RecordingReadStream that wraps the inner stream and matches alert framing), not just exception types.
New unit test CreateAlertFrame_NonProtocolAlert_UsesRequestedVersion in TlsAlertsMatchWindowsInterop pins the TLS 1.0 / 1.1 / 1.2 record framing of CreateAlertFrame, including the (int)version >= Tls fix that
previously excluded TLS 1.0.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The Apple cert-validation path introduced by the previous commits stored the cert exception in alertToken.Status with InternalError, which caused the IO loop to wrap it as AuthenticationException(net_auth_SSPI, inner), diverging from the Windows/Linux/Android behavior where SendAuthResetSignal throws the cert exception directly. Fix by introducing SecurityStatusPalErrorCode.CertValidationFailed and having ForceAuthenticationAsync rethrow the inner exception via ExceptionDispatchInfo when this code is observed, mirroring the SendAuthResetSignal pattern. Also: - Drop redundant _handshakeCompleted = false (field is always false at this point since CompleteHandshake has not run yet). - Assert alertType == Fatal in SslStreamPal.OSX.ApplyAlertToken to document that SecureTransport only emits fatal alerts via SslSetError. - Strengthen the two new OSX cert-alert tests with Assert.Null on InnerException so any future regression of the parity gets caught. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

dotnet-policy-service · 2026-05-18T10:33:34Z

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR updates the macOS (SecureTransport) SslStream handshake flow to explicitly emit a fatal TLS alert record when certificate validation fails, aligning behavior more closely with other platforms. It introduces new handshake/status plumbing for “cert validation needed” and adds Apple-native interop to set SecureTransport’s internal error state.

Changes:

Add Apple PAL support to surface a “certificate validation needed” handshake state and to set a specific TLS alert via a new AppleCryptoNative_SslSetError export.
Update SslStream handshake/token generation to run cert validation at the new pause point on Apple and (on failure) send an alert frame + preserve exception parity via a dedicated CertValidationFailed status.
Add/extend unit + functional tests (including on-the-wire alert bytes capture) and adjust TlsFrameHelper.CreateAlertFrame to handle TLS 1.0 framing.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.h	Adds PAL TLS alert message enum and declares `AppleCryptoNative_SslSetError`.
src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c	Implements alert→OSStatus mapping and `AppleCryptoNative_SslSetError`.
src/native/libs/System.Security.Cryptography.Native.Apple/entrypoints.c	Exposes `AppleCryptoNative_SslSetError` for managed P/Invoke resolution.
src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Ssl.cs	Adds managed `SslSetError` P/Invoke + wrapper.
src/libraries/System.Net.Security/src/System/Net/SecurityStatusPal.cs	Introduces `CertValidationNeeded` and `CertValidationFailed` internal status codes.
src/libraries/System.Net.Security/src/System/Net/Security/TlsFrameHelper.cs	Fixes TLS 1.0 inclusion in `CreateAlertFrame` version handling.
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Windows.cs	Adds `CanGenerateCustomAlertsForContext` shim (constant-backed).
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Unix.cs	Adds `CanGenerateCustomAlertsForContext` shim (constant-backed).
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.Android.cs	Adds `CanGenerateCustomAlertsForContext` shim (constant-backed).
src/libraries/System.Net.Security/src/System/Net/Security/SslStreamPal.OSX.cs	Enables custom alerts for SecureTransport contexts and returns `CertValidationNeeded` at auth-complete pause; applies alerts via `SslSetError`.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Runs cert validation when Apple PAL signals `CertValidationNeeded`; generates on-wire alert payload for SecureTransport contexts; switches alert gating to per-context.
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs	Rethrows cert validation exception directly for `CertValidationFailed` to match other platforms’ exception shape.
src/libraries/System.Net.Security/tests/UnitTests/TlsAlertsMatchWindowsInterop.cs	Adds coverage to pin `CreateAlertFrame` record version bytes for TLS 1.0/1.1/1.2.
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAlertsTest.cs	Adds macOS-only functional tests that assert the actual alert bytes appear on the wire using a recording stream wrapper.

rzikm

LGTM, modulo comments

@rzikm

- Enable OSX in SslStream_NoCallback_UntrustedCert_SendsAlert and SslStream_NoCallback_UntrustedClientCert_ServerSendsAlert instead of adding separate _OSX-suffixed duplicates (per @rzikm). - Drop the culture-dependent assertions on the localized exception message; rely on InnerException-shape parity instead (per Copilot). - Skip the Ssl3 protocol case on macOS where SecureTransport no longer negotiates it (would otherwise time out). - Accept either UnknownCA or BadCertificate as the fatal cert-rejection alert on macOS; SecureTransport varies by protocol but both are valid 'untrusted cert' signals. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

wfurt · 2026-05-27T02:26:43Z

what do we plan for the new NetworkFramework? Are we going to regress when we flip the default?

liveans · 2026-05-27T13:09:40Z

what do we plan for the new NetworkFramework? Are we going to regress when we flip the default?

No, I'm planning to create a separate PR for it, but I believe Network.framework already handles these alerts, so I'll try to improve native certificate handling over there and expect the underlying implementation throw these alerts, and propagate from native layer to managed layer when it's needed.

Resolve enum-addition conflict in SecurityStatusPal.cs by keeping both CertValidationFailed (from this PR) and MutualAuthFailed (from main). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

VerifyRemoteCertificateAndGenerateNextToken released the incoming token's payload unconditionally. SecureTransport pauses the handshake at the peer- auth-completed break before producing the next flight, so the pending- writes buffer drained into the token is expected to be empty. Add a debug assert so any future regression that produced bytes at this point is surfaced loudly instead of silently dropping handshake bytes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace the in-test if (IsOSX && protocol == Ssl3) return; short-circuit with a local MemberData source that omits SSL 3.0 on macOS. The xunit runner now reports the filtered data point rather than silently passing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

The helper already accepts a mask, so express the macOS Ssl3 filter as ~SslProtocols.Ssl3 instead of an open-coded if inside the loop. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

dotnet/runtime#128316 makes macOS emit a fatal TLS alert when SslStream rejects the peer certificate, matching Windows/Linux/Android. As a result, the client's AuthenticateAsClientAsync now throws AuthenticationException during the handshake instead of completing and letting the rejection surface as a post-handshake connection close. Update ValidationFailureRejectsConnection and RejectsConnectionOnSslPolicyErrorsWhenNoValidation to accept either outcome via a shared AssertConnectionRejected helper. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update dependencies from build 319323 Updated Dependencies: Microsoft.NET.Runtime.WebAssembly.Sdk, Microsoft.NETCore.BrowserDebugHost.Transport, Microsoft.NET.Runtime.MonoAOTCompiler.Task, dotnet-ef, Microsoft.Bcl.AsyncInterfaces, Microsoft.Bcl.TimeProvider, Microsoft.EntityFrameworkCore, Microsoft.EntityFrameworkCore.Design, Microsoft.EntityFrameworkCore.InMemory, Microsoft.EntityFrameworkCore.Relational, Microsoft.EntityFrameworkCore.Sqlite, Microsoft.EntityFrameworkCore.SqlServer, Microsoft.EntityFrameworkCore.Tools, Microsoft.Extensions.Caching.Abstractions, Microsoft.Extensions.Caching.Memory, Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions, Microsoft.Extensions.Configuration.Binder, Microsoft.Extensions.Configuration.CommandLine, Microsoft.Extensions.Configuration.EnvironmentVariables, Microsoft.Extensions.Configuration.FileExtensions, Microsoft.Extensions.Configuration.Ini, Microsoft.Extensions.Configuration.Json, Microsoft.Extensions.Configuration.UserSecrets, Microsoft.Extensions.Configuration.Xml, Microsoft.Extensions.DependencyInjection, Microsoft.Extensions.DependencyInjection.Abstractions, Microsoft.Extensions.DependencyModel, Microsoft.Extensions.Diagnostics, Microsoft.Extensions.Diagnostics.Abstractions, Microsoft.Extensions.FileProviders.Abstractions, Microsoft.Extensions.FileProviders.Composite, Microsoft.Extensions.FileProviders.Physical, Microsoft.Extensions.FileSystemGlobbing, Microsoft.Extensions.HostFactoryResolver.Sources, Microsoft.Extensions.Hosting, Microsoft.Extensions.Hosting.Abstractions, Microsoft.Extensions.Http, Microsoft.Extensions.Logging, Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.Logging.Configuration, Microsoft.Extensions.Logging.Console, Microsoft.Extensions.Logging.Debug, Microsoft.Extensions.Logging.EventLog, Microsoft.Extensions.Logging.EventSource, Microsoft.Extensions.Logging.TraceSource, Microsoft.Extensions.Options, Microsoft.Extensions.Options.ConfigurationExtensions, Microsoft.Extensions.Options.DataAnnotations, Microsoft.Extensions.Primitives, Microsoft.Internal.Runtime.AspNetCore.Transport, Microsoft.NETCore.App.Ref, Microsoft.NETCore.Platforms, System.Collections.Immutable, System.Composition, System.Configuration.ConfigurationManager, System.Diagnostics.DiagnosticSource, System.Diagnostics.EventLog, System.Diagnostics.PerformanceCounter, System.DirectoryServices.Protocols, System.Formats.Asn1, System.Formats.Cbor, System.IO.Hashing, System.IO.Pipelines, System.Memory.Data, System.Net.Http.Json, System.Net.Http.WinHttpHandler, System.Net.ServerSentEvents, System.Numerics.Tensors, System.Reflection.Metadata, System.Resources.Extensions, System.Runtime.Caching, System.Security.Cryptography.Pkcs, System.Security.Cryptography.Xml, System.Security.Permissions, System.ServiceProcess.ServiceController, System.Text.Encodings.Web, System.Text.Json, System.Threading.AccessControl, System.Threading.Channels, System.Threading.RateLimiting (Version 11.0.0-preview.6.26317.104 -> 11.0.0-preview.6.26318.105) Microsoft.DotNet.Arcade.Sdk, Microsoft.DotNet.Build.Tasks.Archives, Microsoft.DotNet.Build.Tasks.Installers, Microsoft.DotNet.Build.Tasks.Templating, Microsoft.DotNet.Helix.Sdk, Microsoft.DotNet.RemoteExecutor, Microsoft.DotNet.SharedFramework.Sdk (Version 11.0.0-beta.26317.104 -> 11.0.0-beta.26318.105) Microsoft.Web.Xdt (Version 3.3.0-preview.6.26317.104 -> 3.3.0-preview.6.26318.105) NuGet.Frameworks, NuGet.Packaging, NuGet.Versioning (Version 7.9.0-rc.31804 -> 7.9.0-rc.31905) [[ commit created by automation ]] * Update dependencies from build 319356 Updated Dependencies: Microsoft.NET.Runtime.WebAssembly.Sdk, Microsoft.NETCore.BrowserDebugHost.Transport, Microsoft.NET.Runtime.MonoAOTCompiler.Task, dotnet-ef, Microsoft.Bcl.AsyncInterfaces, Microsoft.Bcl.TimeProvider, Microsoft.EntityFrameworkCore, Microsoft.EntityFrameworkCore.Design, Microsoft.EntityFrameworkCore.InMemory, Microsoft.EntityFrameworkCore.Relational, Microsoft.EntityFrameworkCore.Sqlite, Microsoft.EntityFrameworkCore.SqlServer, Microsoft.EntityFrameworkCore.Tools, Microsoft.Extensions.Caching.Abstractions, Microsoft.Extensions.Caching.Memory, Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions, Microsoft.Extensions.Configuration.Binder, Microsoft.Extensions.Configuration.CommandLine, Microsoft.Extensions.Configuration.EnvironmentVariables, Microsoft.Extensions.Configuration.FileExtensions, Microsoft.Extensions.Configuration.Ini, Microsoft.Extensions.Configuration.Json, Microsoft.Extensions.Configuration.UserSecrets, Microsoft.Extensions.Configuration.Xml, Microsoft.Extensions.DependencyInjection, Microsoft.Extensions.DependencyInjection.Abstractions, Microsoft.Extensions.DependencyModel, Microsoft.Extensions.Diagnostics, Microsoft.Extensions.Diagnostics.Abstractions, Microsoft.Extensions.FileProviders.Abstractions, Microsoft.Extensions.FileProviders.Composite, Microsoft.Extensions.FileProviders.Physical, Microsoft.Extensions.FileSystemGlobbing, Microsoft.Extensions.HostFactoryResolver.Sources, Microsoft.Extensions.Hosting, Microsoft.Extensions.Hosting.Abstractions, Microsoft.Extensions.Http, Microsoft.Extensions.Logging, Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.Logging.Configuration, Microsoft.Extensions.Logging.Console, Microsoft.Extensions.Logging.Debug, Microsoft.Extensions.Logging.EventLog, Microsoft.Extensions.Logging.EventSource, Microsoft.Extensions.Logging.TraceSource, Microsoft.Extensions.Options, Microsoft.Extensions.Options.ConfigurationExtensions, Microsoft.Extensions.Options.DataAnnotations, Microsoft.Extensions.Primitives, Microsoft.Internal.Runtime.AspNetCore.Transport, Microsoft.NETCore.App.Ref, Microsoft.NETCore.Platforms, System.Collections.Immutable, System.Composition, System.Configuration.ConfigurationManager, System.Diagnostics.DiagnosticSource, System.Diagnostics.EventLog, System.Diagnostics.PerformanceCounter, System.DirectoryServices.Protocols, System.Formats.Asn1, System.Formats.Cbor, System.IO.Hashing, System.IO.Pipelines, System.Memory.Data, System.Net.Http.Json, System.Net.Http.WinHttpHandler, System.Net.ServerSentEvents, System.Numerics.Tensors, System.Reflection.Metadata, System.Resources.Extensions, System.Runtime.Caching, System.Security.Cryptography.Pkcs, System.Security.Cryptography.Xml, System.Security.Permissions, System.ServiceProcess.ServiceController, System.Text.Encodings.Web, System.Text.Json, System.Threading.AccessControl, System.Threading.Channels, System.Threading.RateLimiting (Version 11.0.0-preview.6.26318.105 -> 11.0.0-preview.6.26318.108) Microsoft.DotNet.Arcade.Sdk, Microsoft.DotNet.Build.Tasks.Archives, Microsoft.DotNet.Build.Tasks.Installers, Microsoft.DotNet.Build.Tasks.Templating, Microsoft.DotNet.Helix.Sdk, Microsoft.DotNet.RemoteExecutor, Microsoft.DotNet.SharedFramework.Sdk (Version 11.0.0-beta.26318.105 -> 11.0.0-beta.26318.108) Microsoft.Web.Xdt (Version 3.3.0-preview.6.26318.105 -> 3.3.0-preview.6.26318.108) NuGet.Frameworks, NuGet.Packaging, NuGet.Versioning (Version 7.9.0-rc.31905 -> 7.9.0-rc.31908) [[ commit created by automation ]] * Update .NET SDK version in global.json * Remove NETStandard.Library package references The .NET 11 SDK now treats NETStandard.Library as automatically available and emits NU1510 errors when it's explicitly referenced. Remove all explicit references from test projects and analyzer projects. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert "Remove NETStandard.Library package references" This reverts commit dc31d10. * Remove Microsoft.NETCore.Windows.ApiSets package references The .NET 11 SDK now treats Microsoft.NETCore.Windows.ApiSets as automatically available and emits NU1510 errors when it's explicitly referenced. Remove the explicit references from the two IIS integration testing projects. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fixup * Regenerate expired testCert.pfx The static src/Shared/TestCertificates/testCert.pfx expired on 2025-02-21. A newer macOS runtime ingested by the codeflow aborts the TLS handshake with 'certificate expired' when the server presents an expired cert, breaking HttpsConnectionMiddlewareTests on the OSX.26.Arm64 PR queue. Regenerate with identical properties (self-signed CN=localhost, RSA-2048/SHA256, SAN DNS:localhost, EKU serverAuth, critical KeyUsage, legacy 3DES PBE / SHA1 MAC, password 'testPassword') and a long validity (notAfter 2126). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Tolerate handshake-time cert rejection in Kestrel HTTPS tests dotnet/runtime#128316 makes macOS emit a fatal TLS alert when SslStream rejects the peer certificate, matching Windows/Linux/Android. As a result, the client's AuthenticateAsClientAsync now throws AuthenticationException during the handshake instead of completing and letting the rejection surface as a post-handshake connection close. Update ValidationFailureRejectsConnection and RejectsConnectionOnSslPolicyErrorsWhenNoValidation to accept either outcome via a shared AssertConnectionRejected helper. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update dependencies from build 319491 Updated Dependencies: Microsoft.NET.Runtime.WebAssembly.Sdk, Microsoft.NETCore.BrowserDebugHost.Transport, Microsoft.NET.Runtime.MonoAOTCompiler.Task, dotnet-ef, Microsoft.Bcl.AsyncInterfaces, Microsoft.Bcl.TimeProvider, Microsoft.EntityFrameworkCore, Microsoft.EntityFrameworkCore.Design, Microsoft.EntityFrameworkCore.InMemory, Microsoft.EntityFrameworkCore.Relational, Microsoft.EntityFrameworkCore.Sqlite, Microsoft.EntityFrameworkCore.SqlServer, Microsoft.EntityFrameworkCore.Tools, Microsoft.Extensions.Caching.Abstractions, Microsoft.Extensions.Caching.Memory, Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.Abstractions, Microsoft.Extensions.Configuration.Binder, Microsoft.Extensions.Configuration.CommandLine, Microsoft.Extensions.Configuration.EnvironmentVariables, Microsoft.Extensions.Configuration.FileExtensions, Microsoft.Extensions.Configuration.Ini, Microsoft.Extensions.Configuration.Json, Microsoft.Extensions.Configuration.UserSecrets, Microsoft.Extensions.Configuration.Xml, Microsoft.Extensions.DependencyInjection, Microsoft.Extensions.DependencyInjection.Abstractions, Microsoft.Extensions.DependencyModel, Microsoft.Extensions.Diagnostics, Microsoft.Extensions.Diagnostics.Abstractions, Microsoft.Extensions.FileProviders.Abstractions, Microsoft.Extensions.FileProviders.Composite, Microsoft.Extensions.FileProviders.Physical, Microsoft.Extensions.FileSystemGlobbing, Microsoft.Extensions.HostFactoryResolver.Sources, Microsoft.Extensions.Hosting, Microsoft.Extensions.Hosting.Abstractions, Microsoft.Extensions.Http, Microsoft.Extensions.Logging, Microsoft.Extensions.Logging.Abstractions, Microsoft.Extensions.Logging.Configuration, Microsoft.Extensions.Logging.Console, Microsoft.Extensions.Logging.Debug, Microsoft.Extensions.Logging.EventLog, Microsoft.Extensions.Logging.EventSource, Microsoft.Extensions.Logging.TraceSource, Microsoft.Extensions.Options, Microsoft.Extensions.Options.ConfigurationExtensions, Microsoft.Extensions.Options.DataAnnotations, Microsoft.Extensions.Primitives, Microsoft.Internal.Runtime.AspNetCore.Transport, Microsoft.NETCore.App.Ref, Microsoft.NETCore.Platforms, System.Collections.Immutable, System.Composition, System.Configuration.ConfigurationManager, System.Diagnostics.DiagnosticSource, System.Diagnostics.EventLog, System.Diagnostics.PerformanceCounter, System.DirectoryServices.Protocols, System.Formats.Asn1, System.Formats.Cbor, System.IO.Hashing, System.IO.Pipelines, System.Memory.Data, System.Net.Http.Json, System.Net.Http.WinHttpHandler, System.Net.ServerSentEvents, System.Numerics.Tensors, System.Reflection.Metadata, System.Resources.Extensions, System.Runtime.Caching, System.Security.Cryptography.Pkcs, System.Security.Cryptography.Xml, System.Security.Permissions, System.ServiceProcess.ServiceController, System.Text.Encodings.Web, System.Text.Json, System.Threading.AccessControl, System.Threading.Channels, System.Threading.RateLimiting (Version 11.0.0-preview.6.26318.108 -> 11.0.0-preview.6.26319.103) Microsoft.DotNet.Arcade.Sdk, Microsoft.DotNet.Build.Tasks.Archives, Microsoft.DotNet.Build.Tasks.Installers, Microsoft.DotNet.Build.Tasks.Templating, Microsoft.DotNet.Helix.Sdk, Microsoft.DotNet.RemoteExecutor, Microsoft.DotNet.SharedFramework.Sdk (Version 11.0.0-beta.26318.108 -> 11.0.0-beta.26319.103) Microsoft.Web.Xdt (Version 3.3.0-preview.6.26318.108 -> 3.3.0-preview.6.26319.103) NuGet.Frameworks, NuGet.Packaging, NuGet.Versioning (Version 7.9.0-rc.31908 -> 7.9.0-rc.32003) [[ commit created by automation ]] --------- Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: William Godbe <wigodbe@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

liveans and others added 3 commits April 27, 2026 15:48

Support certificate validation alerts on macOS

0172194

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Gate macOS alert fallback by TLS implementation

6dba9f3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

liveans self-assigned this May 18, 2026

Copilot AI review requested due to automatic review settings May 18, 2026 10:32

Copilot started reviewing on behalf of liveans May 18, 2026 10:32 View session

github-actions Bot added the area-System.Net.Security label May 18, 2026

Copilot AI reviewed May 18, 2026

View reviewed changes

Comment thread src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAlertsTest.cs Outdated

Comment thread src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAlertsTest.cs Outdated

rzikm approved these changes May 19, 2026

View reviewed changes

Comment thread src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAlertsTest.cs Outdated

Comment thread src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAlertsTest.cs Outdated

liveans and others added 2 commits May 23, 2026 22:16

Merge branch 'main' into fix-osx-cert-validation-alerts

0231107

Copilot AI review requested due to automatic review settings May 25, 2026 18:59

Copilot started reviewing on behalf of liveans May 25, 2026 18:59 View session

liveans marked this pull request as ready for review May 25, 2026 18:59

Copilot AI reviewed May 25, 2026

View reviewed changes

Comment thread src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c

Comment thread src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs

Comment thread src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAlertsTest.cs Outdated

This was referenced May 25, 2026

"We stopped hearing from agent Azure Pipelines 32. Verify the agent machine is running and has a healthy network connection" dotnet/dnceng#1886

Open

XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796

Open

liveans and others added 2 commits June 8, 2026 13:14

Merge branch 'main' into fix-osx-cert-validation-alerts

5b44015

Resolve enum-addition conflict in SecurityStatusPal.cs by keeping both CertValidationFailed (from this PR) and MutualAuthFailed (from main). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 8, 2026 12:36

Copilot started reviewing on behalf of liveans June 8, 2026 12:36 View session

rzikm reviewed Jun 8, 2026

View reviewed changes

Comment thread src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAlertsTest.cs Outdated

Copilot AI reviewed Jun 8, 2026

View reviewed changes

Comment thread src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs

Use EnumerateSupportedProtocols mask overload to filter Ssl3 on macOS

6a4edeb

The helper already accepts a mask, so express the macOS Ssl3 filter as ~SslProtocols.Ssl3 instead of an open-coded if inside the loop. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 8, 2026 13:09

Copilot started reviewing on behalf of liveans June 8, 2026 13:09 View session

Copilot AI reviewed Jun 8, 2026

View reviewed changes

Comment thread src/libraries/System.Net.Security/src/System/Net/SecurityStatusPal.cs

Comment thread src/libraries/System.Net.Security/src/System/Net/SecurityStatusPal.cs

liveans merged commit d6db569 into dotnet:main Jun 11, 2026
116 checks passed

dotnet-maestro Bot mentioned this pull request Jun 11, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#7196

Merged

dotnet-milestone-bot Bot added this to the 11.0-preview6 milestone Jun 17, 2026

Conversation

liveans commented May 18, 2026

Summary

Previous behavior (macOS, SecureTransport)

New behavior

Design notes

Why an explicit plaintext alert frame?

CanGenerateCustomAlertsForContext

Cross-platform exception parity

Tests

Uh oh!

dotnet-policy-service Bot commented May 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

rzikm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wfurt commented May 27, 2026

Uh oh!

liveans commented May 27, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants