System.Net.Security TLS resumption and client-certificate tests fail together on Windows

[svick]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1542869
Build error leg or test failing: System.Net.Security.Tests — Windows x64 Debug
Pull request: #131876

Error Message

{
  "ErrorPattern": "System\\.Net\\.Security\\.Tests\\.(SslStreamTlsResumeTests\\.ClientChangeCert_NoResume|SslStreamNetworkStreamTest\\.SslStream_NegotiateClientCertificateAsyncTls13_Succeeds)",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Three related TLS tests failed in the same work item:

System.Net.Security.Tests.SslStreamTlsResumeTests.ClientChangeCert_NoResume(sslProtocol: Tls12) [FAIL]
  Assert.Equal() Failure: Values differ
  Expected: False
  Actual:   True

System.Net.Security.Tests.SslStreamTlsResumeTests.ClientChangeCert_NoResume(sslProtocol: Tls13) [FAIL]
  Assert.Equal() Failure: Values differ
  Expected: False
  Actual:   True

System.Net.Security.Tests.SslStreamNetworkStreamTest.SslStream_NegotiateClientCertificateAsyncTls13_Succeeds(sendClientCertificate: False) [FAIL]
  Assert.Null() Failure: Value is not null
  Expected: null
  Actual:   [Subject]
    CN=testselfsignedclienteku.contoso.com

The first two failures show that connections resumed after changing the client certificate, when resumption was expected to be disabled. The third unexpectedly received a client certificate when none should have been sent.

Because all failures occurred in the same Windows work item and involve retained TLS session/client-certificate state, they may share an underlying SChannel session-cache or resumption issue.

This is potentially related to #58927, but the observed assertions and failure behavior are different.

Note

This issue was drafted with GitHub Copilot.

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1542869
Error message validated: [System\.Net\.Security\.Tests\.(SslStreamTlsResumeTests\.ClientChangeCert_NoResume|SslStreamNetworkStreamTest\.SslStream_NegotiateClientCertificateAsyncTls13_Succeeds)]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 8/7/2026 11:29:53 AM UTC

Report

Build	Repository	Test	Pull Request
1544993	dotnet/runtime	System.Net.Security.Tests.SslStreamTlsResumeTests.ClientChangeCert_NoResume	#131909
1544676	dotnet/runtime	System.Net.Security.Tests.SslStreamTlsResumeTests.ClientChangeCert_NoResume	#132012
1544534	dotnet/runtime	System.Net.Security.Tests.SslStreamStreamToStreamTest_MemoryAsync.MalformedPacketsDuringHandshake_ThrowsAuthenticationException	#131044
1544255	dotnet/runtime	System.Net.Security.Tests.SslStreamTlsResumeTests.ClientCert_DefaultValue_ResumeSucceeds	#131991
1542869	dotnet/runtime	System.Net.Security.Tests.SslStreamTlsResumeTests.ClientChangeCert_NoResume	#131876
1543955	dotnet/runtime	System.Net.Security.Tests.ServerAsyncAuthenticateTest.ServerAsyncAuthenticate_EachSupportedProtocol_Success	#131986

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	6	6

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.