Port diagnostic for certs with ephemeral keys on Windows to S.N.Q (#97819)

rzikm · web-flow · commit 524598aecf36 · 2024-02-05T10:50:58.000+01:00
* Add diagnostic for ephemeral certificate keys

* Deduplicate some test code

* Add Client-side test
diff --git a/src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs b/src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs
@@ -42,7 +42,7 @@ public static partial class Certificates
             private static X509Certificate2Collection s_dynamicCaCertificates;
             private static object certLock = new object();
 
-     
+
             // These Get* methods make a copy of the certificates so that consumers own the lifetime of the
             // certificates handed back.  Consumers are expected to dispose of their certs when done with them.
 
@@ -99,7 +99,7 @@ public static void CleanupCertificates([CallerMemberName] string? testName = nul
                 catch { };
             }
 
-            private static X509ExtensionCollection BuildTlsServerCertExtensions(string serverName)
+            internal static X509ExtensionCollection BuildTlsServerCertExtensions(string serverName)
             {
                 return BuildTlsCertExtensions(serverName, true);
             }
@@ -120,7 +120,7 @@ private static X509ExtensionCollection BuildTlsCertExtensions(string targetName,
                 return extensions;
             }
 
-            public static (X509Certificate2 certificate, X509Certificate2Collection) GenerateCertificates(string targetName, [CallerMemberName] string? testName = null, bool longChain = false, bool serverCertificate = true)
+            public static (X509Certificate2 certificate, X509Certificate2Collection) GenerateCertificates(string targetName, [CallerMemberName] string? testName = null, bool longChain = false, bool serverCertificate = true, bool ephemeralKey = false)
             {
                 const int keySize = 2048;
                 if (PlatformDetection.IsWindows && testName != null)
@@ -161,10 +161,10 @@ public static (X509Certificate2 certificate, X509Certificate2Collection) Generat
                 responder.Dispose();
                 root.Dispose();
 
-                if (PlatformDetection.IsWindows)
+                if (!ephemeralKey && PlatformDetection.IsWindows)
                 {
                     X509Certificate2 ephemeral = endEntity;
-                    endEntity = new X509Certificate2(endEntity.Export(X509ContentType.Pfx));
+                    endEntity = new X509Certificate2(endEntity.Export(X509ContentType.Pfx), (string?)null, X509KeyStorageFlags.Exportable);
                     ephemeral.Dispose();
                 }
 
diff --git a/src/libraries/System.Net.Quic/src/Resources/Strings.resx b/src/libraries/System.Net.Quic/src/Resources/Strings.resx
@@ -233,5 +233,8 @@
   <data name="net_quic_callback_error" xml:space="preserve">
     <value>User configured callback failed.</value>
   </data>
+  <data name="net_auth_ephemeral" xml:space="preserve">
+    <value>Authentication failed because the platform does not support ephemeral keys.</value>
+  </data>
 </root>
 
diff --git a/src/libraries/System.Net.Quic/src/System.Net.Quic.csproj b/src/libraries/System.Net.Quic/src/System.Net.Quic.csproj
@@ -65,6 +65,18 @@
     <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.certificates_types.cs" Link="Common\Interop\Windows\Crypt32\Interop.certificates_types.cs" />
     <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CertEnumCertificatesInStore.cs" Link="Common\Interop\Windows\Crypt32\Interop.CertEnumCertificatesInStore.cs" />
     <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.MsgEncodingType.cs" Link="Common\Interop\Windows\Crypt32\Interop.Interop.MsgEncodingType.cs" />
+    <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CertContextPropId.cs"
+      Link="Common\Interop\Windows\Crypt32\Interop.CertContextPropId.cs" />
+    <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CertDuplicateCertificateContext.cs"
+      Link="Common\Interop\Windows\Crypt32\Interop.CertDuplicateCertificateContex.cs" />
+    <Compile Include="$(CommonPath)Interop\Windows\Crypt32\Interop.CertGetCertificateContextProperty_NO_NULLABLE.cs"
+      Link="Common\Interop\Windows\Crypt32\Interop.CertGetCertificateContextProperty_NO_NULLABLE.cs" />
+    <Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeCrypt32Handle.cs"
+      Link="Common\Microsoft\Win32\SafeHandles\SafeCrypt32Handle.cs" />
+    <Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeHandleCache.cs"
+      Link="Common\Microsoft\Win32\SafeHandles\SafeHandleCache.cs" />
+    <Compile Include="$(CommonPath)Microsoft\Win32\SafeHandles\SafeCertContextHandle.cs"
+      Link="Common\Microsoft\Win32\SafeHandles\SafeCertContextHandle.cs" />
     <Compile Include="$(CommonPath)Interop\Windows\SChannel\Interop.SECURITY_STATUS.cs" Link="Common\Interop\Windows\SChannel\Interop.SECURITY_STATUS.cs" />
     <Compile Include="$(CommonPath)System\Net\Security\CertificateValidation.Windows.cs" Link="Common\System\Net\Security\CertificateValidation.Windows.cs" />
     <Compile Include="$(CommonPath)System\Net\SocketAddressPal.Windows.cs" Link="Common\System\Net\SocketAddressPal.Windows.cs" />
diff --git a/src/libraries/System.Net.Quic/src/System/Net/Quic/Internal/MsQuicConfiguration.cs b/src/libraries/System.Net.Quic/src/System/Net/Quic/Internal/MsQuicConfiguration.cs
@@ -3,6 +3,7 @@
 
 using System.Collections.Generic;
 using System.Collections.ObjectModel;
+using System.Security.Authentication;
 using System.Net.Security;
 using System.Security.Cryptography.X509Certificates;
 using System.Threading;
@@ -253,6 +254,15 @@ private static unsafe MsQuicSafeHandle Create(QuicConnectionOptions options, QUI
             {
                 ThrowHelper.ThrowIfMsQuicError(status, SR.net_quic_tls_version_notsupported);
             }
+
+            if (status == MsQuic.QUIC_STATUS_CERT_NO_CERT && certificate != null && certificate.HasPrivateKey())
+            {
+                using Microsoft.Win32.SafeHandles.SafeCertContextHandle safeCertContextHandle = Interop.Crypt32.CertDuplicateCertificateContext(certificate.Handle);
+                if (safeCertContextHandle.HasEphemeralPrivateKey)
+                {
+                    throw new AuthenticationException(SR.net_auth_ephemeral);
+                }
+            }
 #endif
 
             ThrowHelper.ThrowIfMsQuicError(status, "ConfigurationLoadCredential failed");
diff --git a/src/libraries/System.Net.Quic/tests/FunctionalTests/MsQuicTests.cs b/src/libraries/System.Net.Quic/tests/FunctionalTests/MsQuicTests.cs
@@ -729,6 +729,91 @@ public async Task ConnectWithClientCertificate(bool sendCertificate, ClientCertS
             await serverConnection.DisposeAsync();
         }
 
+        [Fact]
+        [PlatformSpecific(TestPlatforms.Windows)]
+        public async Task Server_CertificateWithEphemeralKey_Throws()
+        {
+            (X509Certificate2 serverCertificate, X509Certificate2Collection chain) = Configuration.Certificates.GenerateCertificates(nameof(Server_CertificateWithEphemeralKey_Throws), ephemeralKey: true);
+            Configuration.Certificates.CleanupCertificates(nameof(Server_CertificateWithEphemeralKey_Throws));
+
+            try
+            {
+                QuicListenerOptions listenerOptions = new QuicListenerOptions()
+                {
+                    ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+                    ApplicationProtocols = new List<SslApplicationProtocol>() { ApplicationProtocol },
+                    ConnectionOptionsCallback = (_, _, _) =>
+                    {
+                        var serverOptions = CreateQuicServerOptions();
+                        serverOptions.ServerAuthenticationOptions.ServerCertificate = null;
+                        serverOptions.ServerAuthenticationOptions.ServerCertificateContext = SslStreamCertificateContext.Create(serverCertificate, chain);
+                        return ValueTask.FromResult(serverOptions);
+                    }
+                };
+                await using QuicListener listener = await CreateQuicListener(listenerOptions);
+
+                QuicClientConnectionOptions clientOptions = CreateQuicClientOptions(listener.LocalEndPoint);
+                clientOptions.ClientAuthenticationOptions.RemoteCertificateValidationCallback = delegate { return true; };
+
+                // client connection attempt will fail
+                await Assert.ThrowsAsync<AuthenticationException>(async () => await CreateQuicConnection(clientOptions));
+
+                // server-side failure will be reported from AcceptConnectionAsync
+                AuthenticationException e = await Assert.ThrowsAsync<AuthenticationException>(async () => await listener.AcceptConnectionAsync());
+                Assert.Contains("ephemeral", e.Message);
+            }
+            finally
+            {
+                Configuration.Certificates.CleanupCertificates(nameof(Server_CertificateWithEphemeralKey_Throws));
+                serverCertificate.Dispose();
+                foreach (X509Certificate c in chain)
+                {
+                    c.Dispose();
+                }
+            }
+        }
+
+        [Fact]
+        [PlatformSpecific(TestPlatforms.Windows)]
+        public async Task Client_CertificateWithEphemeralKey_Throws()
+        {
+            (X509Certificate2 clientCertificate, X509Certificate2Collection chain) = Configuration.Certificates.GenerateCertificates(nameof(Client_CertificateWithEphemeralKey_Throws), ephemeralKey: true);
+            Configuration.Certificates.CleanupCertificates(nameof(Client_CertificateWithEphemeralKey_Throws));
+
+            try
+            {
+                QuicListenerOptions listenerOptions = new QuicListenerOptions()
+                {
+                    ListenEndPoint = new IPEndPoint(IPAddress.Loopback, 0),
+                    ApplicationProtocols = new List<SslApplicationProtocol>() { ApplicationProtocol },
+                    ConnectionOptionsCallback = (_, _, _) =>
+                    {
+                        var serverOptions = CreateQuicServerOptions();
+                        serverOptions.ServerAuthenticationOptions.ClientCertificateRequired = true;
+                        serverOptions.ServerAuthenticationOptions.RemoteCertificateValidationCallback = delegate { return true; };
+                        return ValueTask.FromResult(serverOptions);
+                    }
+                };
+                await using QuicListener listener = await CreateQuicListener(listenerOptions);
+
+                QuicClientConnectionOptions clientOptions = CreateQuicClientOptions(listener.LocalEndPoint);
+                clientOptions.ClientAuthenticationOptions.ClientCertificates = new X509CertificateCollection() { clientCertificate };
+                clientOptions.ClientAuthenticationOptions.RemoteCertificateValidationCallback = delegate { return true; };
+
+                AuthenticationException e = await Assert.ThrowsAsync<AuthenticationException>(async () => await CreateQuicConnection(clientOptions));
+                Assert.Contains("ephemeral", e.Message);
+            }
+            finally
+            {
+                Configuration.Certificates.CleanupCertificates(nameof(Client_CertificateWithEphemeralKey_Throws));
+                clientCertificate.Dispose();
+                foreach (X509Certificate c in chain)
+                {
+                    c.Dispose();
+                }
+            }
+        }
+
         [Theory]
         [InlineData(false)]
         [InlineData(true)]
diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/CertificateValidationRemoteServer.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/CertificateValidationRemoteServer.cs
@@ -204,7 +204,7 @@ private async Task ConnectWithRevocation_WithCallback_Core(
                 intermediateAuthorityCount: noIntermediates ? 0 : 1,
                 subjectName: serverName,
                 keySize: 2048,
-                extensions: TestHelper.BuildTlsServerCertExtensions(serverName));
+                extensions: Configuration.Certificates.BuildTlsServerCertExtensions(serverName));
 
             CertificateAuthority issuingAuthority = noIntermediates ? rootAuthority : intermediateAuthorities[0];
             X509Certificate2 issuerCert = issuingAuthority.CloneIssuerCert();
diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCertificateContextTests.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCertificateContextTests.cs
@@ -9,6 +9,8 @@
 
 namespace System.Net.Security.Tests
 {
+    using Configuration = System.Net.Test.Common.Configuration;
+
     public static class SslStreamCertificateContextTests
     {
         [Fact]
@@ -27,7 +29,7 @@ public static async Task Create_OcspDoesNotReturnOrCacheInvalidStapleData()
                 intermediateAuthorityCount: 1,
                 subjectName: serverName,
                 keySize: 2048,
-                extensions: TestHelper.BuildTlsServerCertExtensions(serverName));
+                extensions: Configuration.Certificates.BuildTlsServerCertExtensions(serverName));
 
             using (responder)
             using (rootAuthority)
diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCertificateTrustTests.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamCertificateTrustTests.cs
@@ -22,7 +22,7 @@ public class SslStreamCertificateTrustTest
         [SkipOnPlatform(TestPlatforms.Windows, "CertificateCollection-based SslCertificateTrust is not Supported on Windows")]
         public async Task SslStream_SendCertificateTrust_CertificateCollection()
         {
-            (X509Certificate2 certificate, X509Certificate2Collection caCerts) = TestHelper.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));
+            (X509Certificate2 certificate, X509Certificate2Collection caCerts) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));
 
             SslCertificateTrust trust = SslCertificateTrust.CreateForX509Collection(caCerts, sendTrustInHandshake: true);
             string[] acceptableIssuers = await ConnectAndGatherAcceptableIssuers(trust);
@@ -94,7 +94,7 @@ await TestConfiguration.WhenAllOrAnyFailedWithTimeout(
         [PlatformSpecific(TestPlatforms.Windows)]
         public void SslStream_SendCertificateTrust_CertificateCollection_ThrowsOnWindows()
         {
-            (X509Certificate2 certificate, X509Certificate2Collection caCerts) = TestHelper.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));
+            (X509Certificate2 certificate, X509Certificate2Collection caCerts) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));
 
             Assert.Throws<PlatformNotSupportedException>(() => SslCertificateTrust.CreateForX509Collection(caCerts, sendTrustInHandshake: true));
         }
@@ -103,7 +103,7 @@ public void SslStream_SendCertificateTrust_CertificateCollection_ThrowsOnWindows
         [SkipOnPlatform(TestPlatforms.Windows, "Windows tested separately")]
         public void SslStream_SendCertificateTrust_ThrowsOnUnsupportedPlatform()
         {
-            (X509Certificate2 certificate, X509Certificate2Collection caCerts) = TestHelper.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));
+            (X509Certificate2 certificate, X509Certificate2Collection caCerts) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));
 
             using X509Store store = new X509Store("Root", StoreLocation.LocalMachine);
 
diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs
@@ -28,7 +28,7 @@ public class CertificateSetup : IDisposable
         public CertificateSetup()
         {
             TestHelper.CleanupCertificates(nameof(SslStreamNetworkStreamTest));
-            (serverCert, serverChain) = TestHelper.GenerateCertificates("localhost", nameof(SslStreamNetworkStreamTest), longChain: true);
+            (serverCert, serverChain) = Configuration.Certificates.GenerateCertificates("localhost", nameof(SslStreamNetworkStreamTest), longChain: true);
         }
 
         public void Dispose()
@@ -863,7 +863,7 @@ public async Task SslStream_ClientCertificate_SendsChain()
             StoreName storeName = OperatingSystem.IsMacOS() ? StoreName.My : StoreName.CertificateAuthority;
             List<SslStream> streams = new List<SslStream>();
             TestHelper.CleanupCertificates(nameof(SslStream_ClientCertificate_SendsChain), storeName);
-            (X509Certificate2 clientCertificate, X509Certificate2Collection clientChain) = TestHelper.GenerateCertificates(nameof(SslStream_ClientCertificate_SendsChain), serverCertificate: false);
+            (X509Certificate2 clientCertificate, X509Certificate2Collection clientChain) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_ClientCertificate_SendsChain), serverCertificate: false);
 
             using (X509Store store = new X509Store(storeName, StoreLocation.CurrentUser))
             {
@@ -918,7 +918,7 @@ public async Task SslStream_ClientCertificate_SendsChain()
         [ActiveIssue("https://github.com/dotnet/runtime/issues/68206", TestPlatforms.Android)]
         public async Task SslStream_ClientCertificateContext_SendsChain()
         {
-            (X509Certificate2 clientCertificate, X509Certificate2Collection clientChain) = TestHelper.GenerateCertificates(nameof(SslStream_ClientCertificateContext_SendsChain), serverCertificate: false);
+            (X509Certificate2 clientCertificate, X509Certificate2Collection clientChain) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_ClientCertificateContext_SendsChain), serverCertificate: false);
             TestHelper.CleanupCertificates(nameof(SslStream_ClientCertificateContext_SendsChain));
 
             var clientOptions = new SslClientAuthenticationOptions()
@@ -942,7 +942,7 @@ public async Task SslStream_ClientCertificateContext_SendsChain()
         [PlatformSpecific(TestPlatforms.Windows)]
         public async Task SslStream_EphemeralKey_Throws()
         {
-            (X509Certificate2 serverCertificate, X509Certificate2Collection chain) = TestHelper.GenerateCertificates(nameof(SslStream_EphemeralKey_Throws), ephemeralKey: true);
+            (X509Certificate2 serverCertificate, X509Certificate2Collection chain) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_EphemeralKey_Throws), ephemeralKey: true);
             TestHelper.CleanupCertificates(nameof(SslStream_EphemeralKey_Throws));
 
             var clientOptions = new SslClientAuthenticationOptions()
diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSniTest.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamSniTest.cs
@@ -243,7 +243,7 @@ public async Task UnencodedHostName_ValidatesCertificate()
             string rawHostname = "räksmörgås.josefsson.org";
             string punycodeHostname = "xn--rksmrgs-5wao1o.josefsson.org";
 
-            var (serverCert, serverChain) = TestHelper.GenerateCertificates(punycodeHostname);
+            var (serverCert, serverChain) = Configuration.Certificates.GenerateCertificates(punycodeHostname);
             try
             {
                 SslServerAuthenticationOptions serverOptions = new SslServerAuthenticationOptions()
diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/System.Net.Security.Tests.csproj b/src/libraries/System.Net.Security/tests/FunctionalTests/System.Net.Security.Tests.csproj
@@ -67,6 +67,8 @@
              Link="Common\System\Net\Configuration.Security.cs" />
     <Compile Include="$(CommonTestPath)System\Net\Configuration.Certificates.cs"
              Link="Common\System\Net\Configuration.Certificates.cs" />
+    <Compile Include="$(CommonTestPath)System\Net\Configuration.Certificates.Dynamic.cs"
+             Link="TestCommon\System\Net\Configuration.Certificates.Dynamic.cs" />
     <Compile Include="$(CommonTestPath)System\Net\Configuration.Http.cs"
              Link="Common\System\Net\Configuration.Http.cs" />
     <Compile Include="$(CommonTestPath)System\Net\HttpsTestClient.cs"
diff --git a/src/libraries/System.Net.Security/tests/FunctionalTests/TestHelper.cs b/src/libraries/System.Net.Security/tests/FunctionalTests/TestHelper.cs

Original file line number	Diff line number	Diff line change
`@@ -42,7 +42,7 @@ public static partial class Certificates`
`42`	`42`	`private static X509Certificate2Collection s_dynamicCaCertificates;`
`43`	`43`	`private static object certLock = new object();`
`44`	`44`
`45`		`-`
	`45`	`+`
`46`	`46`	`// These Get* methods make a copy of the certificates so that consumers own the lifetime of the`
`47`	`47`	`// certificates handed back. Consumers are expected to dispose of their certs when done with them.`
`48`	`48`
`@@ -99,7 +99,7 @@ public static void CleanupCertificates([CallerMemberName] string? testName = nul`
`99`	`99`	`catch { };`
`100`	`100`	`}`
`101`	`101`
`102`		`- private static X509ExtensionCollection BuildTlsServerCertExtensions(string serverName)`
	`102`	`+ internal static X509ExtensionCollection BuildTlsServerCertExtensions(string serverName)`
`103`	`103`	`{`
`104`	`104`	`return BuildTlsCertExtensions(serverName, true);`
`105`	`105`	`}`
`@@ -120,7 +120,7 @@ private static X509ExtensionCollection BuildTlsCertExtensions(string targetName,`
`120`	`120`	`return extensions;`
`121`	`121`	`}`
`122`	`122`
`123`		`- public static (X509Certificate2 certificate, X509Certificate2Collection) GenerateCertificates(string targetName, [CallerMemberName] string? testName = null, bool longChain = false, bool serverCertificate = true)`
	`123`	`+ public static (X509Certificate2 certificate, X509Certificate2Collection) GenerateCertificates(string targetName, [CallerMemberName] string? testName = null, bool longChain = false, bool serverCertificate = true, bool ephemeralKey = false)`
`124`	`124`	`{`
`125`	`125`	`const int keySize = 2048;`
`126`	`126`	`if (PlatformDetection.IsWindows && testName != null)`
`@@ -161,10 +161,10 @@ public static (X509Certificate2 certificate, X509Certificate2Collection) Generat`
`161`	`161`	`responder.Dispose();`
`162`	`162`	`root.Dispose();`
`163`	`163`
`164`		`- if (PlatformDetection.IsWindows)`
	`164`	`+ if (!ephemeralKey && PlatformDetection.IsWindows)`
`165`	`165`	`{`
`166`	`166`	`X509Certificate2 ephemeral = endEntity;`
`167`		`- endEntity = new X509Certificate2(endEntity.Export(X509ContentType.Pfx));`
	`167`	`+ endEntity = new X509Certificate2(endEntity.Export(X509ContentType.Pfx), (string?)null, X509KeyStorageFlags.Exportable);`
`168`	`168`	`ephemeral.Dispose();`
`169`	`169`	`}`
`170`	`170`
Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@ public class SslStreamCertificateTrustTest`
`22`	`22`	`[SkipOnPlatform(TestPlatforms.Windows, "CertificateCollection-based SslCertificateTrust is not Supported on Windows")]`
`23`	`23`	`public async Task SslStream_SendCertificateTrust_CertificateCollection()`
`24`	`24`	`{`
`25`		`- (X509Certificate2 certificate, X509Certificate2Collection caCerts) = TestHelper.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));`
	`25`	`+ (X509Certificate2 certificate, X509Certificate2Collection caCerts) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));`
`26`	`26`
`27`	`27`	`SslCertificateTrust trust = SslCertificateTrust.CreateForX509Collection(caCerts, sendTrustInHandshake: true);`
`28`	`28`	`string[] acceptableIssuers = await ConnectAndGatherAcceptableIssuers(trust);`
`@@ -94,7 +94,7 @@ await TestConfiguration.WhenAllOrAnyFailedWithTimeout(`
`94`	`94`	`[PlatformSpecific(TestPlatforms.Windows)]`
`95`	`95`	`public void SslStream_SendCertificateTrust_CertificateCollection_ThrowsOnWindows()`
`96`	`96`	`{`
`97`		`- (X509Certificate2 certificate, X509Certificate2Collection caCerts) = TestHelper.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));`
	`97`	`+ (X509Certificate2 certificate, X509Certificate2Collection caCerts) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));`
`98`	`98`
`99`	`99`	`Assert.Throws<PlatformNotSupportedException>(() => SslCertificateTrust.CreateForX509Collection(caCerts, sendTrustInHandshake: true));`
`100`	`100`	`}`
`@@ -103,7 +103,7 @@ public void SslStream_SendCertificateTrust_CertificateCollection_ThrowsOnWindows`
`103`	`103`	`[SkipOnPlatform(TestPlatforms.Windows, "Windows tested separately")]`
`104`	`104`	`public void SslStream_SendCertificateTrust_ThrowsOnUnsupportedPlatform()`
`105`	`105`	`{`
`106`		`- (X509Certificate2 certificate, X509Certificate2Collection caCerts) = TestHelper.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));`
	`106`	`+ (X509Certificate2 certificate, X509Certificate2Collection caCerts) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_SendCertificateTrust_CertificateCollection));`
`107`	`107`
`108`	`108`	`using X509Store store = new X509Store("Root", StoreLocation.LocalMachine);`
`109`	`109`
Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ public class CertificateSetup : IDisposable`
`28`	`28`	`public CertificateSetup()`
`29`	`29`	`{`
`30`	`30`	`TestHelper.CleanupCertificates(nameof(SslStreamNetworkStreamTest));`
`31`		`- (serverCert, serverChain) = TestHelper.GenerateCertificates("localhost", nameof(SslStreamNetworkStreamTest), longChain: true);`
	`31`	`+ (serverCert, serverChain) = Configuration.Certificates.GenerateCertificates("localhost", nameof(SslStreamNetworkStreamTest), longChain: true);`
`32`	`32`	`}`
`33`	`33`
`34`	`34`	`public void Dispose()`
`@@ -863,7 +863,7 @@ public async Task SslStream_ClientCertificate_SendsChain()`
`863`	`863`	`StoreName storeName = OperatingSystem.IsMacOS() ? StoreName.My : StoreName.CertificateAuthority;`
`864`	`864`	`List<SslStream> streams = new List<SslStream>();`
`865`	`865`	`TestHelper.CleanupCertificates(nameof(SslStream_ClientCertificate_SendsChain), storeName);`
`866`		`- (X509Certificate2 clientCertificate, X509Certificate2Collection clientChain) = TestHelper.GenerateCertificates(nameof(SslStream_ClientCertificate_SendsChain), serverCertificate: false);`
	`866`	`+ (X509Certificate2 clientCertificate, X509Certificate2Collection clientChain) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_ClientCertificate_SendsChain), serverCertificate: false);`
`867`	`867`
`868`	`868`	`using (X509Store store = new X509Store(storeName, StoreLocation.CurrentUser))`
`869`	`869`	`{`
`@@ -918,7 +918,7 @@ public async Task SslStream_ClientCertificate_SendsChain()`
`918`	`918`	`[ActiveIssue("https://github.com/dotnet/runtime/issues/68206", TestPlatforms.Android)]`
`919`	`919`	`public async Task SslStream_ClientCertificateContext_SendsChain()`
`920`	`920`	`{`
`921`		`- (X509Certificate2 clientCertificate, X509Certificate2Collection clientChain) = TestHelper.GenerateCertificates(nameof(SslStream_ClientCertificateContext_SendsChain), serverCertificate: false);`
	`921`	`+ (X509Certificate2 clientCertificate, X509Certificate2Collection clientChain) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_ClientCertificateContext_SendsChain), serverCertificate: false);`
`922`	`922`	`TestHelper.CleanupCertificates(nameof(SslStream_ClientCertificateContext_SendsChain));`
`923`	`923`
`924`	`924`	`var clientOptions = new SslClientAuthenticationOptions()`
`@@ -942,7 +942,7 @@ public async Task SslStream_ClientCertificateContext_SendsChain()`
`942`	`942`	`[PlatformSpecific(TestPlatforms.Windows)]`
`943`	`943`	`public async Task SslStream_EphemeralKey_Throws()`
`944`	`944`	`{`
`945`		`- (X509Certificate2 serverCertificate, X509Certificate2Collection chain) = TestHelper.GenerateCertificates(nameof(SslStream_EphemeralKey_Throws), ephemeralKey: true);`
	`945`	`+ (X509Certificate2 serverCertificate, X509Certificate2Collection chain) = Configuration.Certificates.GenerateCertificates(nameof(SslStream_EphemeralKey_Throws), ephemeralKey: true);`
`946`	`946`	`TestHelper.CleanupCertificates(nameof(SslStream_EphemeralKey_Throws));`
`947`	`947`
`948`	`948`	`var clientOptions = new SslClientAuthenticationOptions()`
Original file line number	Diff line number	Diff line change
`@@ -243,7 +243,7 @@ public async Task UnencodedHostName_ValidatesCertificate()`
`243`	`243`	`string rawHostname = "räksmörgås.josefsson.org";`
`244`	`244`	`string punycodeHostname = "xn--rksmrgs-5wao1o.josefsson.org";`
`245`	`245`
`246`		`- var (serverCert, serverChain) = TestHelper.GenerateCertificates(punycodeHostname);`
	`246`	`+ var (serverCert, serverChain) = Configuration.Certificates.GenerateCertificates(punycodeHostname);`
`247`	`247`	`try`
`248`	`248`	`{`
`249`	`249`	`SslServerAuthenticationOptions serverOptions = new SslServerAuthenticationOptions()`