Disable AIA certificate downloads for server client-cert validation by default by rzikm · Pull Request #125049 · dotnet/runtime

rzikm · 2026-03-02T13:32:08Z

During TLS handshake, peers should include all intermediate certificates necessary for the other side to perform certificate validation. If intermediates are not sent, it is possible for the receiver to look them up and download using the Authority Information Access extension (AIA).

This behavior is not desirable on server side for multiple reasons:

performance - AIA server may be slow or plain unresponsive, performing network IO as part of certificate validation slows down the handshake.
security - server makes outbound HTTP GET requests to client-provided endpoint.

This PR changes the default behavior of server SslStream instances to disable intermediate cert downloading using AIA by default. Scenarios, where user passes custom X509ChainPolicy are not affected.

This change may break scenarios where client and/or server is not properly configured, meaning either:

client does not send necessary intermediates in the handshake (they were not provided to SslStream in SslStreamCertificateContext, or they are not present in the intermediate CA store on the machine)
server does not have the necessary intermediate certificates in the CA store.

Action to be taken by affected users are either:

configure server auth options with X509ChainPolicy with ExtraStore that contains the necessary intermediates. Note that you also should specify DisableCertificateDownloads = true on the policy as the default is false
(not recommended) specify X509ChainPolicy that allows AIA downloads (DisableCertificateDownloads = false)
install CA certificates to the proper certificate store, so they can be looked up when building the outbound cert chain (client) or when validating client cert (server)

…y default When SslStream operates as a server validating client certificates and no custom X509ChainPolicy has been provided by the user, set DisableCertificateDownloads to true on the chain policy. This prevents the server from making outbound HTTP requests to download intermediate certificates via AIA extensions. Add compat switch System.Net.Security.EnableServerAIADownloads and environment variable DOTNET_SYSTEM_NET_SECURITY_ENABLESERVERAIADOWNLOADS to opt back into the previous behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Updates SslStream server-side client-certificate validation to avoid outbound intermediate-certificate downloads (AIA) by default when the user hasn’t provided a custom X509ChainPolicy, with a compat switch/env-var opt-out.

Changes:

Add System.Net.Security.EnableServerAIADownloads (AppContext) / DOTNET_SYSTEM_NET_SECURITY_ENABLESERVERAIADOWNLOADS (env var) switch plumbing.
When acting as a server and using the default chain policy, set chain.ChainPolicy.DisableCertificateDownloads = true during remote certificate validation.
Add a functional test validating the default behavior and the AppContext compat switch.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs	Adds compat switch handling and applies `DisableCertificateDownloads` on server-side default chain policy.
src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs	Adds RemoteExecutor-based functional coverage for default behavior and AppContext switch.

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs

…disable # Conflicts: # src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs

dotnet-policy-service · 2026-03-02T16:27:49Z

Added needs-breaking-change-doc-created label because this PR has the breaking-change label.

When you commit this breaking change:

Create and link to this PR and the issue a matching issue in the dotnet/docs repo using the breaking change documentation template, then remove this needs-breaking-change-doc-created label.
Ask a committer to mail the .NET Breaking Change Notification DL.

Tagging @dotnet/compat for awareness of the breaking change.

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs

…tream.Protocol.cs Co-authored-by: Jeremy Barton <jbarton@microsoft.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

You can also share your feedback on Copilot code review. Take the survey.

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

You can also share your feedback on Copilot code review. Take the survey.

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs

github-actions · 2026-03-09T09:15:08Z

📋 Breaking Change Documentation Required

Create a breaking change issue with AI-generated content

Generated by Breaking Change Documentation Tool - 2026-03-09 09:15:07

Copilot AI review requested due to automatic review settings March 2, 2026 13:32

github-actions bot added the area-System.Net.Security label Mar 2, 2026

dotnet-policy-service bot assigned rzikm Mar 2, 2026

Copilot started reviewing on behalf of rzikm March 2, 2026 13:33 View session

Copilot AI reviewed Mar 2, 2026

View reviewed changes

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Show resolved Hide resolved

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs Outdated Show resolved Hide resolved

rzikm and others added 2 commits March 2, 2026 15:22

Merge remote-tracking branch 'upstream/main' into server-aia-default-…

5ce95bd

…disable # Conflicts: # src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs

Apply suggestion from @Copilot

d9454ca

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

rzikm requested review from a team and Copilot March 2, 2026 16:11

Copilot started reviewing on behalf of rzikm March 2, 2026 16:12 View session

Copilot AI reviewed Mar 2, 2026

View reviewed changes

src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamRemoteExecutorTests.cs Show resolved Hide resolved

rzikm added the breaking-change Issue or PR that represents a breaking API or functional change over a previous release. label Mar 2, 2026

dotnet-policy-service bot added the needs-breaking-change-doc-created Breaking changes need an issue opened with https://github.com/dotnet/docs/issues/new?template=dotnet label Mar 2, 2026

bartonjs reviewed Mar 2, 2026

View reviewed changes

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Show resolved Hide resolved

rzikm requested review from bartonjs and wfurt March 5, 2026 14:25

bartonjs reviewed Mar 5, 2026

View reviewed changes

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated Show resolved Hide resolved

bartonjs approved these changes Mar 5, 2026

View reviewed changes

Update src/libraries/System.Net.Security/src/System/Net/Security/SslS…

f7d8a81

…tream.Protocol.cs Co-authored-by: Jeremy Barton <jbarton@microsoft.com>

Copilot AI review requested due to automatic review settings March 6, 2026 06:44

rzikm enabled auto-merge (squash) March 6, 2026 06:45

Copilot started reviewing on behalf of rzikm March 6, 2026 06:45 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

build-analysis bot mentioned this pull request Mar 6, 2026

[browser-wasm] System.Reflection.Context.Tests.ExtendedAssemblyTests2.GetModule_ReturnsModule failure #125245

Closed

Apply suggestion from @Copilot

71c624d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 6, 2026 11:19

Copilot started reviewing on behalf of rzikm March 6, 2026 11:20 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs Outdated Show resolved Hide resolved

Improvements

6981bb4

rzikm merged commit bd3fd16 into dotnet:main Mar 9, 2026
86 of 90 checks passed

rzikm mentioned this pull request Mar 9, 2026

[Breaking change]: Disable AIA certificate downloads for client-cert validation on server SslStreams by default dotnet/docs#52118

Open

dotnet-maestro bot mentioned this pull request Mar 10, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#5345

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Disable AIA certificate downloads for server client-cert validation by default#125049

Disable AIA certificate downloads for server client-cert validation by default#125049
rzikm merged 6 commits intodotnet:mainfrom
rzikm:server-aia-default-disable

rzikm commented Mar 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

dotnet-policy-service bot commented Mar 2, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

rzikm commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

dotnet-policy-service bot commented Mar 2, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Mar 9, 2026

📋 Breaking Change Documentation Required

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rzikm commented Mar 2, 2026 •

edited

Loading