Remove unused client certificate from TLS host resumption test - #134422
Conversation
Keep DifferentHost_NoResume independent of certificate credential cache warm-up while preserving resumption and host-isolation assertions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
|
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
No unresolved blocking issues were identified.
Review effort: Lite
Findings: None
What changed in this PR
This test-only PR removes an unused client certificate context from the TLS host-resumption test, improving reliability without changing product behavior.
Changes:
- Simplifies
DifferentHost_NoResumewhile preserving its resumption and hostname assertions.
| File | Description |
|---|---|
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamAllowTlsResumeTests.cs |
Removes the unused client certificate context. |
|
This is curious as unused object has impact on other tests. That looks like Test bug or perhaps product...? While the fix may stabilize the tests it somewhat concerns me. Maybe we should sweep the tests and use unique SNI everywhere....??? |
|
on Windows we fallback on anonymous credentials for the first flight, but the certificate is part of the credential cache key, so maybe there is some interaction there. |
|
/ba-g test failure is unrelated |
DifferentHost_NoResumesupplies a client certificate that the server never requests. With a cold certificate-credential cache on Windows, this leads to fresh anonymous credentials on successive connections, preventing the positive resumption check from reaching the host-change assertion.Remove the unused
ClientCertificateContext. The initial handshake, resumption prerequisite, and negative assertion after changing the hostname remain unchanged. No product behavior changes.Validated with Debug libraries/tests on Windows x64: all three protocol variants failed in isolation before the edit and passed afterward, including 10 additional fresh-process runs (30 passes, no skips). Functional innerloop: 5,275 passed, 36 existing skips; unit tests: 117 passed, 4 existing skips. No failures after the change. Linux and Windows x86 were not run.
Addresses the host-test setup behind #132851; the separate encryption-policy and Linux client-certificate failures are not claimed fixed.
Note
This PR was created with assistance from GitHub Copilot.