Change HttpClient/SslStream default certificate revocation check mode to Online #116098

rzikm · 2025-05-29T15:02:16Z

Set the default certificate revocation mode to online, enhancing security by ensuring that certificate revocation checks are performed by default.

This is a breaking change, which can be opted out by either explicitly specifying X509RevocationMode.NoCheck in code, or by setting the opt-out appctx switch:

System.Net.Security.NoRevocationCheckByDefault appctx switch to true
DOTNET_SYSTEM_NET_SECURITY_NOREVOCATIONCHECKBYDEFAULT environment variable to true

This PR also changes the tests to make sure the corresponding RevocationResponsder is alive and available while we use dynamically generated certificates during the test runs.

dotnet-policy-service · 2025-05-29T15:10:13Z

Added needs-breaking-change-doc-created label because this PR has the breaking-change label.

When you commit this breaking change:

Create and link to this PR and the issue a matching issue in the dotnet/docs repo using the breaking change documentation template, then remove this needs-breaking-change-doc-created label.
Ask a committer to mail the .NET Breaking Change Notification DL.

Tagging @dotnet/compat for awareness of the breaking change.

Copilot

Pull Request Overview

This PR changes the default certificate revocation mode from NoCheck to Online (breaking change), introduces an AppContext switch for opt-out, and updates tests to explicitly set the revocation mode and to use a new PkiHolder helper for certificate lifecycle management.

Introduce SslAuthenticationOptions.DefaultRevocationMode driven by the OfflineRevocationByDefault switch and apply it as the new default in client/server options.
Update unit and functional tests to explicitly set CertificateRevocationCheckMode to NoCheck where needed and refactor certificate generation/cleanup to use PkiHolder.
Adjust HTTP handlers and WinHTTP defaults/tests to reflect the new revocation-list default.

Reviewed Changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/**/SslAuthenticationOptions.cs	Add `DefaultRevocationMode` and hook into AppContext switch
src/**/SslServerAuthenticationOptions.cs & SslClientAuthenticationOptions.cs	Change private `_checkCertificateRevocation` to use the new default
src/**/System.Net.Security.csproj & UnitTests.csproj	Include `AppContextSwitchHelper` in build
src//tests//*	Update tests for explicit revocation settings and refactor certificate setup
src/**/WinHttpHandler.cs & WinHttpHandlerTest.cs	Set default `CheckCertificateRevocationList = true` and tests
src/*/HttpClientHandlerTest.cs	Update default assertions for revocation list
src/**/Configuration.Certificates.Dynamic.cs	Replace manual cert management with new `PkiHolder` class

src/libraries/System.Net.Http/tests/FunctionalTests/SocketsHttpHandlerTest.cs

src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs

bartonjs · 2025-06-05T16:54:34Z

src/libraries/System.Net.Security/src/System/Net/Security/SslAuthenticationOptions.cs

+        internal static readonly X509RevocationMode DefaultRevocationMode =
+            AppContextSwitchHelper.GetBooleanConfig(
+                "System.Net.Security.OfflineRevocationByDefault",
+                "DOTNET_SYSTEM_NET_SECURITY_OFFLINEREVOCATIONBYDEFAULT")
+                ? X509RevocationMode.NoCheck : X509RevocationMode.Online;


I would expect to see some RemoteExecutor tests confirming that these override modes work; like in https://github.com/dotnet/runtime/blob/main/src/libraries/System.Security.Cryptography/tests/X509Certificates/PfxIterationCountTests.CustomAppContextDataLimit.cs

bartonjs · 2025-06-05T16:55:19Z

src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs

@@ -68,7 +68,7 @@ private Func<
            X509Chain,
            SslPolicyErrors,
            bool>? _serverCertificateValidationCallback;
-        private bool _checkCertificateRevocationList;
+        private bool _checkCertificateRevocationList = true;


Should this be true, or should it inspect the appcontext-overridable default mode value?

I can't see from the PR, so: Ensure you have tests where this gets forced to false, instead of only tests that assumed it was false. Ideally tests where the cert is revoked (or the revocation responder is set to explode, or time out, or whatever), so you can tell it worked.

wfurt · 2025-06-05T16:55:59Z

I don't think we should go forward with. It seems like the can have broad and breaking impact so as it can impact perf and reliability. I would much rather update best practices to encourage use where appropriate

bartonjs · 2025-06-05T16:59:26Z

src/libraries/System.Net.Security/src/System/Net/Security/SslClientAuthenticationOptions.cs

@@ -11,7 +11,7 @@ namespace System.Net.Security
    public class SslClientAuthenticationOptions
    {
        private EncryptionPolicy _encryptionPolicy = EncryptionPolicy.RequireEncryption;
-        private X509RevocationMode _checkCertificateRevocation = X509RevocationMode.NoCheck;
+        private X509RevocationMode _checkCertificateRevocation = SslAuthenticationOptions.DefaultRevocationMode;


Like with the WinHttpHandler, double check that you have tests explicitly trying to use NoCheck, rather than just assuming it as a default.

Yes, and there are also HttpClient tests which do the same (so WinHttpHandler is also covered)

azure-pipelines · 2025-06-09T10:11:33Z

Azure Pipelines successfully started running 1 pipeline(s).

rzikm · 2025-06-09T13:04:18Z

/azp run runtime-extra-platforms

azure-pipelines · 2025-06-09T13:04:36Z

Azure Pipelines successfully started running 1 pipeline(s).

rzikm · 2025-06-10T08:27:46Z

/ba-g test failure (System.Runtime.Tests) is unrelated, other failures are known

filipnavara · 2025-06-11T06:04:31Z

Heads up: LetsEncrypt recently deprecated OCSP in favor of CRL. Apple platforms tend to run into issues of not checking the CRL (#25872) and returning 509ChainStatusFlags.RevocationStatusUnknown error. You may want to check this change on some recent Apple macOS machine first against a server with recent LetsEncrypt certificate (eg. http://smartermail.emclient.com/).

rokonec

LGTM

src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs

src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs

src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs

…es.Dynamic.cs

src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs

…es.Dynamic.cs

rzikm · 2025-06-13T10:53:14Z

Benchmark results comparing handshake time with and without revocation checking (they can be easily run on .NET 9)

Benchmark code

BenchmarkDotNet.Running.BenchmarkRunner.Run<RevocationCheckingBenchmark>();

public class RevocationCheckingBenchmark
{
    private PkiHolder _pkiHolder;

    private PipeStream _clientPipe, _serverPipe;    // used for handshake tests
    private NetworkStream _clientIPv4, _serverIPv4; // used for handshake tests
    private readonly byte[] _clientBuffer = new byte[1], _serverBuffer = new byte[1];

    [GlobalSetup]
    public void Setup()
    {
        string pipeName = "SetupTlsHandshakePipe";
        using (var listener = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp))
        {
            listener.Bind(new IPEndPoint(IPAddress.Loopback, 0));
            listener.Listen(1);

            // Create an SslStream pair
            var client = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
            client.Connect(listener.LocalEndPoint);
            Socket server = listener.Accept();

            // Create a IPv4 pair
            client = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp);
            client.Connect(listener.LocalEndPoint);
            server = listener.Accept();
            _clientIPv4 = new NetworkStream(client, ownsSocket: true);
            _serverIPv4 = new NetworkStream(server, ownsSocket: true);
        }

        // Create PIPE Pair.
        var pipeServer = new NamedPipeServerStream(pipeName, PipeDirection.InOut, 1, PipeTransmissionMode.Byte, PipeOptions.Asynchronous | PipeOptions.WriteThrough);
        var pipeClient = new NamedPipeClientStream(".", pipeName, PipeDirection.InOut, PipeOptions.Asynchronous | PipeOptions.WriteThrough);
        Task.WaitAll(pipeServer.WaitForConnectionAsync(), pipeClient.ConnectAsync());
        _serverPipe = pipeServer;
        _clientPipe = pipeClient;
        _pkiHolder = CertificateAuthority.BuildPrivatePki(PkiOptions, nameof(RevocationCheckingBenchmark), subjectName: "Test");
    }

    [GlobalCleanup]
    public void Cleanup()
    {
        _clientPipe.Dispose();
        _serverPipe.Dispose();
        _pkiHolder.Dispose();
    }

    [Params(PkiOptions.AllRevocation, PkiOptions.CrlEverywhere, PkiOptions.OcspEverywhere)]
    public PkiOptions PkiOptions;

    [Params(X509RevocationMode.NoCheck, X509RevocationMode.Online)]
    public X509RevocationMode RevocationMode;

    [Benchmark]
    [IterationCount(10)]
    public Task DefaultHandshakePipeAsync() => DefaultHandshake(_clientIPv4, _serverIPv4, RevocationMode);

    private async Task DefaultHandshake(Stream client, Stream server, X509RevocationMode revocationMode, bool requireClientCert = false)
    {
        SslClientAuthenticationOptions clientOptions = new SslClientAuthenticationOptions
        {
            AllowRenegotiation = false,
            CertificateRevocationCheckMode = revocationMode,
            TargetHost = Guid.NewGuid().ToString(), // Use a random target host to avoid DNS issues
            AllowTlsResume = false,
        };

        SslServerAuthenticationOptions serverOptions = new SslServerAuthenticationOptions
        {
            AllowRenegotiation = false,
            CertificateRevocationCheckMode = revocationMode,
            ServerCertificateContext = _pkiHolder.CreateSslStreamCertificateContext(),
            ClientCertificateRequired = requireClientCert,
            AllowTlsResume = false,
        };

        using (var sslClient = new SslStream(client, leaveInnerStreamOpen: true, delegate { return true; }))
        using (var sslServer = new SslStream(server, leaveInnerStreamOpen: true, delegate { return true; }))
        using (CancellationTokenSource cts = new CancellationTokenSource())
        {
            cts.CancelAfter(TimeSpan.FromSeconds(10));
            await Task.WhenAll(
                sslClient.AuthenticateAsClientAsync(clientOptions, cts.Token),
                sslServer.AuthenticateAsServerAsync(serverOptions, cts.Token));

            // In Tls1.3 part of handshake happens with data exchange.
            await sslClient.WriteAsync(_clientBuffer, cts.Token);
#pragma warning disable CA2022 // Avoid inexact read
            await sslServer.ReadAsync(_serverBuffer, cts.Token);
            await sslServer.WriteAsync(_serverBuffer, cts.Token);
            await sslClient.ReadAsync(_clientBuffer, cts.Token);
#pragma warning restore CA2022
        }
    }
}

BenchmarkDotNet v0.14.0, Windows 11 (10.0.26100.4349)
Intel Core i9-10900K CPU 3.70GHz, 1 CPU, 20 logical and 10 physical cores
.NET SDK 9.0.301
  [Host]     : .NET 9.0.6 (9.0.625.26613), X64 RyuJIT AVX2
  Job-VODIEA : .NET 9.0.6 (9.0.625.26613), X64 RyuJIT AVX2

IterationCount=10

| Method                    | PkiOptions     | RevocationMode | Mean     | Error     | StdDev    |
|-------------------------- |--------------- |--------------- |---------:|----------:|----------:|
| DefaultHandshakePipeAsync | CrlEverywhere  | NoCheck        | 9.765 ms | 0.2233 ms | 0.1329 ms |
| DefaultHandshakePipeAsync | CrlEverywhere  | Online         | 3.397 ms | 0.1072 ms | 0.0709 ms |
| DefaultHandshakePipeAsync | OcspEverywhere | NoCheck        | 3.328 ms | 0.0526 ms | 0.0348 ms |
| DefaultHandshakePipeAsync | OcspEverywhere | Online         | 3.328 ms | 0.0428 ms | 0.0283 ms |
| DefaultHandshakePipeAsync | AllRevocation  | NoCheck        | 3.379 ms | 0.0924 ms | 0.0611 ms |
| DefaultHandshakePipeAsync | AllRevocation  | Online         | 3.323 ms | 0.0579 ms | 0.0345 ms |

BenchmarkDotNet v0.14.0, Ubuntu 24.04.2 LTS (Noble Numbat) WSL
Intel Core i9-10900K CPU 3.70GHz, 1 CPU, 20 logical and 10 physical cores
.NET SDK 9.0.300
  [Host]     : .NET 9.0.5 (9.0.525.21509), X64 RyuJIT AVX2
  Job-RIFECK : .NET 9.0.5 (9.0.525.21509), X64 RyuJIT AVX2

IterationCount=10

| Method                    | PkiOptions     | RevocationMode | Mean     | Error     | StdDev    |
|-------------------------- |--------------- |--------------- |---------:|----------:|----------:|
| DefaultHandshakePipeAsync | CrlEverywhere  | NoCheck        | 3.174 ms | 0.0361 ms | 0.0215 ms |
| DefaultHandshakePipeAsync | CrlEverywhere  | Online         | 3.125 ms | 0.0442 ms | 0.0231 ms |
| DefaultHandshakePipeAsync | OcspEverywhere | NoCheck        | 3.171 ms | 0.0649 ms | 0.0386 ms |
| DefaultHandshakePipeAsync | OcspEverywhere | Online         | 3.135 ms | 0.0347 ms | 0.0230 ms |
| DefaultHandshakePipeAsync | AllRevocation  | NoCheck        | 3.143 ms | 0.0631 ms | 0.0375 ms |
| DefaultHandshakePipeAsync | AllRevocation  | Online         | 3.178 ms | 0.0329 ms | 0.0196 ms |

I am not sure what causes the handshake to take longer in the CrlEverywhere+NoCheck option on windows, but overall it seems like there is no great perf impact on Windows an Linux (I can't check macos right now). probably because the CRL is cached so we still avoid outbound network request for each handshake.

…revocation-checking-by-default-for-SslStreamHttpClient

rzikm · 2025-06-16T06:40:08Z

/azp run runtime-libraries-coreclr outerloop

rzikm · 2025-06-16T06:40:16Z

/azp run runtime-extra-platforms

azure-pipelines · 2025-06-16T06:40:17Z

Azure Pipelines successfully started running 1 pipeline(s).

azure-pipelines · 2025-06-16T06:40:29Z

Azure Pipelines successfully started running 1 pipeline(s).

rzikm · 2025-06-16T09:58:19Z

/ba-g Test failures are unrelated

rzikm · 2025-06-16T10:12:50Z

Breaking change doc issue: dotnet/docs#46824

Change default CertificateRevocationMode to Online

c784242

github-actions bot added the area-System.Net.Security label May 29, 2025

dotnet-policy-service bot assigned rzikm May 29, 2025

stephentoub added the breaking-change Issue or PR that represents a breaking API or functional change over a prerelease. label May 29, 2025

dotnet-policy-service bot added the needs-breaking-change-doc-created Breaking changes need an issue opened with https://github.com/dotnet/docs/issues/new?template=dotnet label May 29, 2025

rzikm added 2 commits May 30, 2025 09:05

Change in WinHttpHandler

e8da401

Fix Tests

c8a8486

This was referenced May 30, 2025

System.Net.Quic.Tests failed with "System.Net.Quic.QuicException : The connection timed out from inactivity." #105177

Open

System.Net.Http.Functional.Tests timeouts #115683

Open

rzikm added 3 commits June 2, 2025 12:08

fixup! Change in WinHttpHandler

74d3607

Make sure RevocationResponder is alive during tests

8916b1a

Fix SMTP test compilation

a2cfc53

rzikm marked this pull request as ready for review June 5, 2025 14:03

rzikm requested review from Copilot, a team, bartonjs, blowdart and GrabYourPitchforks June 5, 2025 14:03

Copilot AI reviewed Jun 5, 2025

View reviewed changes

bartonjs reviewed Jun 5, 2025

View reviewed changes

src/libraries/System.Net.Http/tests/FunctionalTests/SocketsHttpHandlerTest.cs Outdated Show resolved Hide resolved

bartonjs reviewed Jun 5, 2025

View reviewed changes

src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs Show resolved Hide resolved

bartonjs reviewed Jun 5, 2025

View reviewed changes

rzikm requested a review from bartonjs June 9, 2025 10:12

This was referenced Jun 9, 2025

[NativeAOT-iOS] MacCatalyst fails to start/log nativeaot.SmokeTests tests #105804

Open

OSX failure on StringTests.StartsWithNoMatch_StringComparison #112195

Open

karelz added this to the 10.0.0 milestone Jun 10, 2025

rokonec approved these changes Jun 13, 2025

View reviewed changes

src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs Outdated Show resolved Hide resolved

src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs Show resolved Hide resolved

rzikm commented Jun 13, 2025

View reviewed changes

src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs Outdated Show resolved Hide resolved

Update src/libraries/Common/tests/System/Net/Configuration.Certificat…

b70c830

…es.Dynamic.cs

rzikm commented Jun 13, 2025

View reviewed changes

src/libraries/Common/tests/System/Net/Configuration.Certificates.Dynamic.cs Outdated Show resolved Hide resolved

Update src/libraries/Common/tests/System/Net/Configuration.Certificat…

2152d2d

…es.Dynamic.cs

rzikm added 2 commits June 16, 2025 08:27

Merge remote-tracking branch 'upstream/main' into 111704-certificate-…

4d3e7c2

…revocation-checking-by-default-for-SslStreamHttpClient

Merge remote-tracking branch 'upstream/main' into 111704-certificate-…

0976295

…revocation-checking-by-default-for-SslStreamHttpClient

rzikm changed the title ~~Change default CertificateRevocationMode to Online~~ Change HttpClient/SslStream default certificate revocation check mode to Online Jun 16, 2025

rzikm merged commit 6a4b7e3 into dotnet:main Jun 16, 2025
120 of 144 checks passed

rzikm removed the needs-breaking-change-doc-created Breaking changes need an issue opened with https://github.com/dotnet/docs/issues/new?template=dotnet label Jun 16, 2025

rzikm mentioned this pull request Jun 23, 2025

Consider doing certificate revocation checking by default for SslStream/HttpClient #111704

Closed

Change HttpClient/SslStream default certificate revocation check mode to Online #116098

Change HttpClient/SslStream default certificate revocation check mode to Online #116098

Uh oh!

Conversation

rzikm commented May 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service bot commented May 29, 2025 • edited by rzikm Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

bartonjs Jun 5, 2025

Choose a reason for hiding this comment

Uh oh!

rzikm Jun 6, 2025

Choose a reason for hiding this comment

Uh oh!

bartonjs Jun 5, 2025

Choose a reason for hiding this comment

Uh oh!

bartonjs Jun 5, 2025

Choose a reason for hiding this comment

Uh oh!

wfurt commented Jun 5, 2025

Uh oh!

bartonjs Jun 5, 2025

Choose a reason for hiding this comment

Uh oh!

rzikm Jun 6, 2025

Choose a reason for hiding this comment

Uh oh!

azure-pipelines bot commented Jun 9, 2025

Uh oh!

rzikm commented Jun 9, 2025

Uh oh!

azure-pipelines bot commented Jun 9, 2025

Uh oh!

rzikm commented Jun 10, 2025

Uh oh!

filipnavara commented Jun 11, 2025

Uh oh!

rokonec left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rzikm commented Jun 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rzikm commented Jun 16, 2025

Uh oh!

rzikm commented Jun 16, 2025

Uh oh!

azure-pipelines bot commented Jun 16, 2025

Uh oh!

azure-pipelines bot commented Jun 16, 2025

Uh oh!

rzikm commented Jun 16, 2025

Uh oh!

rzikm commented Jun 16, 2025

Uh oh!

Uh oh!

Uh oh!

rzikm commented May 29, 2025 •

edited

Loading

dotnet-policy-service bot commented May 29, 2025 •

edited by rzikm

Loading

rzikm commented Jun 13, 2025 •

edited

Loading