Allow multiple private key references in Unix PFXes

[bartonjs]

Fixes #44535.

Windows has a complicated state for when a PFX contains two certificates that link to the same private key:

• EphemeralKeySet: The PFX load fails.
• PersistKeySet: Things probably work.
• (normal): "It's complicated".

When the Unix PFX loader was written it was based on the EphemeralKeySet behavior, because that's what the tests used (to avoid disk penalties and problems).

Trying to maintain a balance between Herculean efforts of bug-for-bug compatibility and OS variability, this change takes a simpler approach:

• EphemeralKeySet: The PFX load fails, like it will on Windows.
• Otherwise: Let it work (but always with cloned keys, so some of the subtle Windows undesirable states are lost).

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Fixes #44535.

Windows has a complicated state for when a PFX contains two certificates that link to the same private key:

• EphemeralKeySet: The PFX load fails.
• PersistKeySet: Things probably work.
• (normal): "It's complicated".

When the Unix PFX loader was written it was based on the EphemeralKeySet behavior, because that's what the tests used (to avoid disk penalties and problems).

Trying to maintain a balance between Herculean efforts of bug-for-bug compatibility and OS variability, this change takes a simpler approach:

• EphemeralKeySet: The PFX load fails, like it will on Windows.
• Otherwise: Let it work (but always with cloned keys, so some of the subtle Windows undesirable states are lost).

Author:	bartonjs
Assignees:	bartonjs
Labels:	area-System.Security
Milestone:	6.0.0

[mark-raymond]

Is there a way I can test this branch myself?

[bartonjs]

Is there a way I can test this branch myself?

@mark-raymond You should be able to checkout pull/55425/head, or do something like the merge command line instructions suggests:

> git checkout -b bartonjs-relax_unix_pfx_multikey main
> git pull https://github.com/bartonjs/runtime.git relax_unix_pfx_multikey

Then the usual build and such

[vcsjones]

Then the usual build and such

There are docs on using your build here: https://github.com/dotnet/runtime/blob/main/docs/workflow/testing/using-your-build.md.

[bartonjs]

Looks like there's an "Apple is different" case that I missed: In TwoCerts_CrossedKeys I believe the Keychain APIs won't bind the wrong private key to the cert, so we get back a cert where HasPrivateKey is false. Making sure the fix works on a mac before pushing it.