[release/8.0] Dispose the certificate chain elements with the chain

[MackinnonBuck]

Backport of #62531 to release/8.0

Dispose the certificate chain elements with the chain

Fixes an issue in certificate authentication where certificates within a certificate chain were not getting directly disposed.

Description

Failing to dispose each certificate within an X509 chain can create significant GC pressure for applications that frequently perform TLS handshakes. While the previous disposal logic only disposed the X509Chain itself, this PR updates the logic to first enumerate and dispose each certificate in the chain directly.

Customer Impact

The original contribution was from a customer who determined that this issue has a severe negative performance impact on their large scale web application. See #62531 (comment).

Regression?

• Yes
• No

Risk

• High
• Medium
• Low

The change is straightforward and follows an established disposal pattern.

Verification

• Manual (required)
• Automated

Packaging changes reviewed?

• Yes
• No
• N/A

[Copilot]

Pull Request Overview

This PR addresses a resource management issue by ensuring that X509Certificate2 objects in certificate chains are properly disposed. The fix prevents potential memory leaks by manually disposing all certificate chain elements before disposing the chain itself.

Key changes:

• Replace using declarations with try-finally blocks for X509Chain disposal
• Add manual disposal of certificate chain elements before disposing the chain
• Fix a syntax error (semicolon to closing brace)

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/Shared/CertificateGeneration/UnixCertificateManager.cs	Adds proper disposal pattern for X509Chain and its elements, fixes syntax error
src/Security/Authentication/Certificate/src/CertificateAuthenticationHandler.cs	Implements the same disposal pattern for certificate validation

Comments suppressed due to low confidence (1)

src/Shared/CertificateGeneration/UnixCertificateManager.cs:178

• This appears to be fixing a syntax error where a semicolon was incorrectly used instead of a closing brace.

        }