[ci-scan] Test failure: System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert

[github-actions]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1526583
Build error leg or test failing: libraries-pgo / System.Net.Security.Tests - System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert

Also observed in runtime-coreclr libraries-jitstress (definition 138).

Error Details

System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert(protocol: Tls12) [FAIL]
  Assert.Throws() Failure: No exception was thrown
  Expected: typeof(System.Security.Authentication.AuthenticationException)
  Stack Trace:
    /_/src/libraries/System.Net.Security/tests/FunctionalTests/TlsSessionTests.cs(452,0): at System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert(SslProtocols protocol)

Error Message

{
  "ErrorMessage": "SslStreamServer_RejectsClientCert_ClientObservesAlert(protocol: Tls12) [FAIL]",
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Note

This issue was generated by the ci-failure-scan Copilot workflow (AI-generated). Verify details before acting.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by CI Outer-Loop Failure Scanner · 638.1 AIC · ⌖ 17.1 AIC · ⊞ 18.7K · ◷

Report

Build	Repository	Test	Pull Request
1532438	dotnet/runtime	System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert	#131554
1532151	dotnet/runtime	System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert	#131500
1531997	dotnet/runtime	System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert	#131445

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
3	3	3

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[github-actions]

Workflow artifact: ci-fix
Artifact kind: handoff
Linked KBE: #131528

Note

AI/Copilot-generated triage note.

This Known Build Error has no producible automated code change (reason: codegen-stress pipeline — the failure reproduces only under libraries-pgo (def 146) and libraries-jitstress (def 138), both codegen-stress legs I must not auto-patch), so I could not open even a best-effort PR. Looping in owners so it can be fixed forward rather than muted.

Root cause (best analysis)

System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert(protocol: Tls12) asserts that a client-cert rejection surfaces as an AuthenticationException, but under the PGO/JITStress legs no exception is thrown (Assert.Throws() Failure: No exception was thrown). The test at src/libraries/System.Net.Security/tests/FunctionalTests/TlsSessionTests.cs(452) distinguishes the OpenSSL Tls12 "reject mid-handshake" path (inHandshake) from the SChannel/TLS1.3 "alert on first encrypted I/O" path. On the PGO/JITStress legs the handshake timing appears to shift so the expected mid-handshake rejection does not materialize within the assertion window. Because it only reproduces under codegen stress, the correct fix (test-timing hardening vs. a genuine stress-only handshake regression) is a networking + codegen judgment call, not a mechanical edit.

Evidence

• Failing build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1526583
• Also observed in runtime-coreclr libraries-jitstress (def 138)
• Possible related PR: none identified with sufficient confidence

Suggested reviewers / area contacts

• Area owners (area-System.Net.Security): @karelz, @bartonjs, @vcsjones, @dotnet/ncl

A fix would likely involve confirming whether this is a stress-only handshake-timing artifact (harden the test's wait/assert for the mid-handshake reject path) or a real regression in client-cert alert surfacing under optimized codegen.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by CI Outer-Loop Failure Fixer · 287.5 AIC · ⌖ 18.4 AIC · ⊞ 17.4K · ◷