diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/TlsSessionTests.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/TlsSessionTests.cs
index 5c3cc362160848..db6fc5e1eef6f6 100644
--- a/src/libraries/System.Net.Security/tests/FunctionalTests/TlsSessionTests.cs
+++ b/src/libraries/System.Net.Security/tests/FunctionalTests/TlsSessionTests.cs
@@ -1498,10 +1498,8 @@ await DriveHandshakeWithExternalValidationAsync(
         [Fact]
         public async Task ClientSession_ExternalCertificateValidation_AcceptWithDefaultValidation_FailsOnUntrustedCert()
         {
-            // The test cert chain isn't installed in the system trust store, so the default
-            // validation policy must report at least RemoteCertificateChainErrors.
-            using X509Certificate2 serverCert = TestCertificates.GetServerCertificate();
-            string serverName = serverCert.GetNameInfo(X509NameType.SimpleName, forIssuer: false);
+            const string serverName = "localhost";
+            using TestCertificates.PkiHolder pkiHolder = TestCertificates.GenerateCertificates(serverName);
 
             (Stream clientStream, Stream serverStream) = TestHelper.GetConnectedStreams();
             using (clientStream)
@@ -1517,7 +1515,7 @@ public async Task ClientSession_ExternalCertificateValidation_AcceptWithDefaultV
 
                 Task serverHandshake = serverSsl.AuthenticateAsServerAsync(new SslServerAuthenticationOptions
                 {
-                    ServerCertificate = serverCert,
+                    ServerCertificateContext = pkiHolder.CreateSslStreamCertificateContext(),
                     EnabledSslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13,
                     ClientCertificateRequired = false,
                 });
@@ -1539,7 +1537,7 @@ await DriveHandshakeWithExternalValidationAsync(
                 await serverHandshake.WaitAsync(TimeSpan.FromSeconds(30));
                 await clientHandshake.WaitAsync(TimeSpan.FromSeconds(30));
 
-                Assert.NotEqual(SslPolicyErrors.None, observedErrors);
+                Assert.Equal(SslPolicyErrors.RemoteCertificateChainErrors, observedErrors);
 
                 // Encrypt must now throw because validation reported errors.
                 byte[] plain = "should-fail"u8.ToArray();