[release/5.0] rebuild certificate context if we use client cert from credential cache

[wfurt]

Fixes #47580

Customer Impact

Heavily upvoted customer report of regression in 5.0.

TLS handshake can sometimes fail when client certificates are used for authentication.
This depends on server configuration as well on internal SslStream caching.
In general, this is difficult to predict and diagnose in the field.

Cause: in 5.0 we added options to provide full certificate chain to avoid work on every connection. That also removed certificate chain building from PAL and moved it up so it is done only when needed. That logic missed one place when the chain is not rebuilt when credential cache is used for client certificate. In such case we fail to include intermediate certificates in TLS handshake and that can lead to handshake failure. It works on first attempt (covered by tests) but it may fail on subsequent attempts when cache is used. (missed by current tests)

Regression?

yes. same scenarios work with 3.1 and got broken in 5.0.

Risk

very low. This is minimal change to get on par with 3.1

Testing

We did not have any tests to cover cases when credential cache is used. This changes adds basic to cover the scenario e.g. try client auth few times while creating conditions for cache lookup.

[ghost]

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Customer Impact

TLS handshake can sometimes fail when client certificates are used for authentication.
This depend on server configuration as well on internal SslStream caching.
In general, this is difficult to predict and diagnose in the field.

In 5.0 we added options to provide full certificate chain to avoid work on every connection. That also removed certificate chain building from PAL and moved it up so it is done only when needed. That logic missed one place when the chain is not rebuilt when credential cache is used for client certificate. In such case we fail to include intermediate certificates in TLS handshake and that can lead to handshake failure. It works on first attempt (covered by tests) but it may fail on subsequent attempts when cache is used. (missed by current tests)

Regression?

yes. same scenarios work with 3.1 and got broken in 5.0.

Risk

very low. This is minimal change to get on par with 3.1

Testing

We did not have any tests to cover cases when credential cache is used. This changes adds basic to cover the scenario e.g. try client auth few times while creating conditions for cache lookup.

Author:	wfurt
Assignees:	wfurt
Labels:	Servicing-consider, area-System.Net.Security
Milestone:	5.0.x

[danmoseley]

@wfurt tactics says approved if @bartonjs signs off.

BTW I see some possibly related test failures.

[danmoseley]

BTW I see some possibly related test failures

I tried to rerun the legs that appeared to have unrelated test failures, but ended up rerunning them all. But you can still see the test failure in Azdo.

[wfurt]

Thanks @danmosemsft. I will take a look.