SslStreamNetworkStreamTest failures "The remote certificate is invalid because of errors in the certificate chain: PartialChain"

[EgorBo]

Widespread failures on CI

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=960836
Build error leg or test failing:

Error Message

Fill the error message using step by step known issues guidance.

{
  "ErrorMessage": "The remote certificate is invalid because of errors in the certificate chain: PartialChain",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=960836
Error message validated: [The remote certificate is invalid because of errors in the certificate chain: PartialChain]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 2/24/2025 12:02:22 PM UTC

Report

Build	Definition	Test	Pull Request
961989	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112891
961946	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112833
961927	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112895
961840	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112878
961829	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112826
961811	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112892
961792	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112891
961780	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112168
961750	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112889
961713	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112888
961687	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112705
961664	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112883
961574	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112884
961566	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112352
961503	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#111626
961474	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112457
961420	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112736
961383	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#111934
961399	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112879
961374	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#111933
961413	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK
961356	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112728
961317	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112876
961301	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112875
961331	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112874
961258	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112872
961240	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112817
961252	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112864
961167	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112352
961205	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#111759
961156	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112730
961085	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112863
961075	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112796
961063	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#110472
961045	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112753
961015	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112853
960957	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#111229
960984	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112787
960942	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112736
960946	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112736
960859	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112824
960836	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#111933
960829	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#111626
960826	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#112851
960841	dotnet/runtime	System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_ServerUntrustedCaWithCustomTrust_OK	#111791

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
45	45	45

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[EgorBo]

Looks like it might be #112567 cc @rzikm @wfurt

[rzikm]

Yes, interestingly, it did not show in build analysis on the PR, will investigate

[wfurt]

I'm wondering if we can restore now session that was created just with certificate...? Or possibly different chain if the certificate was cross-signed (not this case) When the cache was linked to context we did not have that problem.

[EgorBo]

I assume it failed only on pipelines which ran on runtime/jit changes only. It looks like it's not the first time (see this) so maybe we should run these pipelines on changes in System Security stuff as well?

[rzikm]

I assume it failed only on pipelines which ran on runtime/jit changes only.

The test failed on the PR as well, it just did not show in the Build Analysis. The failure is deterministic and would show on all outerloop pipeline runs.

I'm wondering if we can restore now session that was created just with certificate...? Or possibly different chain if the certificate was cross-signed (not this case) When the cache was linked to context we did not have that problem.

That is what I found, we need to include all cert(hashes) in the cache key