[Test failure] System.Net.Http.Functional.Tests.PlatformHandler_HttpClientHandler_ServerCertificates_Test.NoCallback_RevokedCertificate_NoRevocationChecking_Succeeds

[runfoapp]

Runfo Tracking Issue: [Test failure] NoCallback_RevokedCertificate_NoRevocationChecking_Succeeds

Build	Definition	Kind	Run Name

Build Result Summary

Day Hit Count	Week Hit Count	Month Hit Count
0	0	0

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Runfo Tracking Issue: [Test failure] NoCallback_RevokedCertificate_NoRevocationChecking_Succeeds

Build	Definition	Kind	Run Name	Console	Core Dump	Test Results	Run Client
69118	runtime-libraries-coreclr outerloop	Rolling	net48-windows-Release-x64-Windows.11.Amd64.Client.Open	console.log			runclient.py
69118	runtime-libraries-coreclr outerloop	Rolling	net48-windows-Release-x86-Windows.10.Amd64.Client21H1.Open	console.log			runclient.py
69115	runtime-libraries-coreclr outerloop-windows	Rolling	net48-windows-Release-x86-Windows.10.Amd64.Client21H1.Open	console.log			runclient.py
69115	runtime-libraries-coreclr outerloop-windows	Rolling	net48-windows-Release-x64-Windows.11.Amd64.Client.Open	console.log			runclient.py
69113	runtime-libraries-coreclr outerloop	Rolling	net48-windows-Release-x86-Windows.10.Amd64.Client21H1.Open	console.log			runclient.py
69113	runtime-libraries-coreclr outerloop	Rolling	net48-windows-Release-x64-Windows.11.Amd64.Client.Open	console.log			runclient.py
69111	runtime-libraries-coreclr outerloop-windows	Rolling	net48-windows-Release-x64-Windows.11.Amd64.Client.Open	console.log			runclient.py
69111	runtime-libraries-coreclr outerloop-windows	Rolling	net48-windows-Release-x86-Windows.10.Amd64.Client21H1.Open	console.log			runclient.py
67858	runtime-libraries-coreclr outerloop	Rolling	net48-windows-Release-x64-Windows.11.Amd64.Client.Open	console.log			runclient.py
67858	runtime-libraries-coreclr outerloop	Rolling	net48-windows-Release-x86-Windows.10.Amd64.Client21H1.Open	console.log			runclient.py
67854	runtime-libraries-coreclr outerloop	Rolling	net48-windows-Release-x86-Windows.10.Amd64.Client21H1.Open	console.log			runclient.py
67854	runtime-libraries-coreclr outerloop	Rolling	net48-windows-Release-x64-Windows.11.Amd64.Client.Open	console.log			runclient.py
67853	runtime-libraries-coreclr outerloop-windows	Rolling	net48-windows-Release-x64-Windows.11.Amd64.Client.Open	console.log			runclient.py
67853	runtime-libraries-coreclr outerloop-windows	Rolling	net48-windows-Release-x86-Windows.10.Amd64.Client21H1.Open	console.log			runclient.py
67850	runtime-libraries-coreclr outerloop-windows	Rolling	net48-windows-Release-x86-Windows.10.Amd64.Client21H1.Open	console.log			runclient.py
67850	runtime-libraries-coreclr outerloop-windows	Rolling	net48-windows-Release-x64-Windows.11.Amd64.Client.Open	console.log			runclient.py

Build Result Summary

Day Hit Count	Week Hit Count	Month Hit Count
4	8	8

Author:	runfoapp[bot]
Assignees:	-
Labels:	area-System.Net.Http, untriaged
Milestone:	-

[ManickaP]

Based on the console log, the error is this:

System.Net.Http.Functional.Tests.PlatformHandler_HttpClientHandler_ServerCertificates_Test.NoCallback_RevokedCertificate_NoRevocationChecking_Succeeds [FAIL]
      System.Net.Http.HttpRequestException : An error occurred while sending the request.
      ---- System.Net.Http.WinHttpException : Error 12175 calling WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, 'A security error occurred'.
      Stack Trace:
           at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
           at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
        /_/src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.ServerCertificates.cs(234,0): at System.Net.Http.Functional.Tests.HttpClientHandler_ServerCertificates_Test.<NoCallback_RevokedCertificate_NoRevocationChecking_Succeeds>d__19.MoveNext()
        --- End of stack trace from previous location where exception was thrown ---
           at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
           at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
        --- End of stack trace from previous location where exception was thrown ---
           at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
           at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
        --- End of stack trace from previous location where exception was thrown ---
           at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
           at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
        ----- Inner Stack Trace -----
           at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
        /_/src/libraries/Common/src/System/Threading/Tasks/RendezvousAwaitable.cs(64,0): at System.Threading.Tasks.RendezvousAwaitable`1.GetResult()
        /_/src/libraries/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpHandler.cs(946,0): at System.Net.Http.WinHttpHandler.<StartRequestAsync>d__122.MoveNext()

Docs for 12175 ERROR_WINHTTP_SECURE_FAILURE: One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server. To determine what type of error was encountered, check for a WINHTTP_CALLBACK_STATUS_SECURE_FAILURE notification in a status callback function. For more information, see WINHTTP_STATUS_CALLBACK.

Seems like cert problem, can it be expired? And if I get the description right, does it mean there are more details about the error available? If so, would it be worthwhile to retrieve them?
cc @wfurt @rzikm

[wfurt]

We should try to reproduce it. If it is expired certificate it will show up consistently.

[ManickaP]

Triage: needs to be tested locally if it's a cert problem (should be easily reproducible). If so, we should promptly fix this or disable the test.

[wfurt]

The test is using https://revoked.badssl.com/ and it expired 10/27. Since this is outer loop test we may ignore it for few more days. The badssl.com usually fix their certs eventually.
It is still shown as revoked so we may alternatively fix the validation tests to ignore expiration and only check revocation.
But I'm not sure if it is worth of the troubles.
Last option IMHO is to remove dependency on badssl.com and host our own sites.

[wfurt]

BTW this is easy to reproduce and SocketsHttpHandler fails as well

[rzikm]

badssl issue: chromium/badssl.com#515