Throws a specific exception when a certificate is needed but not provided by rolfbjarne · Pull Request #24544 · dotnet/macios

rolfbjarne · 2026-01-22T12:03:02Z

This allows the user to detect the specific exception when a certificate is needed and react to it. Exceptions thrown are very similar to what SocketsHttpHandler and other handlers throw, while also following the pattern of other exceptions thrown by NSUrlSessionHandler.

This is a re-creation of #24532 from @dotMorten (due to our CI not being able to build PRs from forks).

Copilot

Pull request overview

This PR adds specific exception handling for scenarios where a server requests a client certificate but none is provided by the application. The implementation throws a structured exception chain (HttpRequestException → WebException → AuthenticationException) to help developers detect and handle missing certificate scenarios programmatically.

Changes:

Modified NSUrlSessionHandler to throw a specific exception when a client certificate is requested but not available
Added an AppContext switch to allow disabling the new behavior for backward compatibility
Added two test methods to validate optional and required certificate scenarios

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
src/Foundation/NSUrlSessionHandler.cs	Adds exception handling logic when client certificate is missing, with AppContext switch for backward compatibility
tests/monotouch-test/System.Net.Http/MessageHandlers.cs	Adds two test methods: one for optional certificates (should succeed) and one for required certificates (should throw specific exception)

src/Foundation/NSUrlSessionHandler.cs

tests/monotouch-test/System.Net.Http/MessageHandlers.cs

src/Foundation/NSUrlSessionHandler.cs

vs-mobiletools-engineering-service2 · 2026-02-12T14:42:56Z

💻 [CI Build #df9f7f9] Tests on macOS arm64 - Mac Sequoia (15) passed 💻

✅ All tests on macOS arm64 - Mac Sequoia (15) passed.

Pipeline on Agent
Hash: df9f7f93197d59ced9f3ff1e790dfa90bc858910 [PR build]

vs-mobiletools-engineering-service2 · 2026-02-12T14:42:58Z

💻 [CI Build #df9f7f9] Tests on macOS M1 - Mac Monterey (12) passed 💻

✅ All tests on macOS M1 - Mac Monterey (12) passed.

Pipeline on Agent
Hash: df9f7f93197d59ced9f3ff1e790dfa90bc858910 [PR build]

vs-mobiletools-engineering-service2 · 2026-02-12T14:43:39Z

💻 [CI Build #df9f7f9] Tests on macOS X64 - Mac Sonoma (14) passed 💻

✅ All tests on macOS X64 - Mac Sonoma (14) passed.

Pipeline on Agent
Hash: df9f7f93197d59ced9f3ff1e790dfa90bc858910 [PR build]

vs-mobiletools-engineering-service2 · 2026-02-12T14:44:13Z

💻 [CI Build #df9f7f9] Tests on macOS M1 - Mac Ventura (13) passed 💻

✅ All tests on macOS M1 - Mac Ventura (13) passed.

Pipeline on Agent
Hash: df9f7f93197d59ced9f3ff1e790dfa90bc858910 [PR build]

vs-mobiletools-engineering-service2 · 2026-02-12T14:45:36Z

💻 [CI Build #df9f7f9] Tests on macOS arm64 - Mac Tahoe (26) passed 💻

✅ All tests on macOS arm64 - Mac Tahoe (26) passed.

Pipeline on Agent
Hash: df9f7f93197d59ced9f3ff1e790dfa90bc858910 [PR build]

…ided

Verifies that when the Foundation.NSUrlSessionHandler.NoMissingCertificateHandling switch is enabled, the specific SecureChannelFailure exception is not thrown. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

src/Foundation/NSUrlSessionHandler.cs

tests/monotouch-test/System.Net.Http/MessageHandlers.cs

- Use challenge.ProposedCredential instead of null for PerformDefaultHandling. - Fix grammar: 'services uses' -> 'services use'. - Track listener error state and throw on Failed instead of silently returning a broken listener. - Dispose ManualResetEventSlim. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

SecIdentity.Import(X509Certificate2) re-exports the cert as PFX which fails on macOS because the private key can't be re-exported. Instead, export the PFX bytes with a password directly from CreateSelfSigned and use SecIdentity.Import(byte[], string) which avoids the re-export. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vs-mobiletools-engineering-service2 · 2026-03-30T14:25:59Z

✅ [CI Build #06189b2] Build passed (Build packages) ✅

Pipeline on Agent
Hash: 06189b289869de9ff6b4ed89d641f3fd288abc84 [PR build]

vs-mobiletools-engineering-service2 · 2026-03-30T14:52:55Z

✅ [CI Build #06189b2] Build passed (Build macOS tests) ✅

Pipeline on Agent
Hash: 06189b289869de9ff6b4ed89d641f3fd288abc84 [PR build]

vs-mobiletools-engineering-service2 · 2026-04-01T07:42:13Z

✅ [PR Build #06189b2] Build passed (Detect API changes) ✅

Pipeline on Agent
Hash: 06189b289869de9ff6b4ed89d641f3fd288abc84 [PR build]

vs-mobiletools-engineering-service2 · 2026-04-01T07:57:11Z

✅ API diff for current PR / commit

NET (empty diffs)

iOS: vsdrops gist ( No breaking changes )
tvOS: vsdrops gist ( No breaking changes )
MacCatalyst: vsdrops gist ( No breaking changes )
macOS: vsdrops gist ( No breaking changes )

✅ API diff vs stable

NET (empty diffs)

iOS: vsdrops gist ( No breaking changes )
tvOS: vsdrops gist ( No breaking changes )
MacCatalyst: vsdrops gist ( No breaking changes )
macOS: vsdrops gist ( No breaking changes )

ℹ️ Generator diff

Generator Diff: vsdrops (html) vsdrops (raw diff) gist (raw diff) - Please review changes)

Pipeline on Agent
Hash: 06189b289869de9ff6b4ed89d641f3fd288abc84 [PR build]

vs-mobiletools-engineering-service2 · 2026-04-01T16:20:56Z

🔥 [CI Build #06189b2] Test results 🔥

Test results

❌ Tests failed on VSTS: test results

0 tests crashed, 1 tests failed, 155 tests passed.

Failures

❌ linker tests [attempt 4]

1 tests failed, 43 tests passed.

Failed tests

trimmode link/iOS - simulator/Release: LaunchFailure

Html Report (VSDrops) Download

Successes

✅ cecil: All 1 tests passed. Html Report (VSDrops) Download
✅ dotnettests (iOS): All 1 tests passed. [attempt 2] Html Report (VSDrops) Download
✅ dotnettests (MacCatalyst): All 1 tests passed. Html Report (VSDrops) Download
✅ dotnettests (macOS): All 1 tests passed. [attempt 2] Html Report (VSDrops) Download
✅ dotnettests (Multiple platforms): All 1 tests passed. Html Report (VSDrops) Download
✅ dotnettests (tvOS): All 1 tests passed. [attempt 2] Html Report (VSDrops) Download
✅ framework: All 2 tests passed. [attempt 2] Html Report (VSDrops) Download
✅ fsharp: All 4 tests passed. [attempt 2] Html Report (VSDrops) Download
✅ generator: All 5 tests passed. Html Report (VSDrops) Download
✅ interdependent-binding-projects: All 4 tests passed. Html Report (VSDrops) Download
✅ introspection: All 6 tests passed. Html Report (VSDrops) Download
✅ monotouch (iOS): All 11 tests passed. Html Report (VSDrops) Download
✅ monotouch (MacCatalyst): All 15 tests passed. Html Report (VSDrops) Download
✅ monotouch (macOS): All 12 tests passed. Html Report (VSDrops) Download
✅ monotouch (tvOS): All 11 tests passed. [attempt 2] Html Report (VSDrops) Download
✅ msbuild: All 2 tests passed. Html Report (VSDrops) Download
✅ sharpie: All 1 tests passed. Html Report (VSDrops) Download
✅ windows: All 3 tests passed. Html Report (VSDrops) Download
✅ xcframework: All 4 tests passed. Html Report (VSDrops) Download
✅ xtro: All 1 tests passed. [attempt 2] Html Report (VSDrops) Download

macOS tests

✅ Tests on macOS Monterey (12): All 5 tests passed. Html Report (VSDrops) Download
✅ Tests on macOS Ventura (13): All 5 tests passed. Html Report (VSDrops) Download
✅ Tests on macOS Sonoma (14): All 5 tests passed. Html Report (VSDrops) Download
✅ Tests on macOS Sequoia (15): All 5 tests passed. Html Report (VSDrops) Download
✅ Tests on macOS Tahoe (26): All 5 tests passed. Html Report (VSDrops) Download

Linux Build Verification

✅ Linux build succeeded

Pipeline on Agent
Hash: 06189b289869de9ff6b4ed89d641f3fd288abc84 [PR build]

rolfbjarne requested a review from Copilot January 22, 2026 12:03

rolfbjarne added the community Community contribution ❤ label Jan 22, 2026

Copilot started reviewing on behalf of rolfbjarne January 22, 2026 12:03 View session

rolfbjarne mentioned this pull request Jan 22, 2026

Throws a specific exception when a certificate is needed but not provided #24532

Closed

Copilot AI reviewed Jan 22, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

dalexsoto approved these changes Jan 22, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

Morten Nielsen and others added 4 commits March 27, 2026 12:22

Throws a specific exception when a certificate is needed but not prov…

99db6f5

…ided

Handle servers where certificates are optional

959db48

Tests by copilot.

359782a

Add test for NoMissingCertificateHandling opt-out switch

4e047fd

Verifies that when the Foundation.NSUrlSessionHandler.NoMissingCertificateHandling switch is enabled, the specific SecureChannelFailure exception is not thrown. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

rolfbjarne force-pushed the dev/rolf/dotMorten-detect_missing_cert branch from df9f7f9 to 4e047fd Compare March 27, 2026 14:38

rolfbjarne requested a review from Copilot March 27, 2026 14:52

Copilot started reviewing on behalf of rolfbjarne March 27, 2026 14:53 View session

Copilot AI reviewed Mar 27, 2026

View reviewed changes

src/Foundation/NSUrlSessionHandler.cs Outdated Show resolved Hide resolved

tests/monotouch-test/System.Net.Http/MessageHandlers.cs Show resolved Hide resolved

Conversation

rolfbjarne commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

vs-mobiletools-engineering-service2 commented Feb 12, 2026

💻 [CI Build #df9f7f9] Tests on macOS arm64 - Mac Sequoia (15) passed 💻

Uh oh!

vs-mobiletools-engineering-service2 commented Feb 12, 2026

💻 [CI Build #df9f7f9] Tests on macOS M1 - Mac Monterey (12) passed 💻

Uh oh!

vs-mobiletools-engineering-service2 commented Feb 12, 2026

💻 [CI Build #df9f7f9] Tests on macOS X64 - Mac Sonoma (14) passed 💻

Uh oh!

vs-mobiletools-engineering-service2 commented Feb 12, 2026

💻 [CI Build #df9f7f9] Tests on macOS M1 - Mac Ventura (13) passed 💻

Uh oh!

vs-mobiletools-engineering-service2 commented Feb 12, 2026

💻 [CI Build #df9f7f9] Tests on macOS arm64 - Mac Tahoe (26) passed 💻

Uh oh!

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

vs-mobiletools-engineering-service2 commented Mar 30, 2026

✅ [CI Build #06189b2] Build passed (Build packages) ✅

Uh oh!

vs-mobiletools-engineering-service2 commented Mar 30, 2026

✅ [CI Build #06189b2] Build passed (Build macOS tests) ✅

Uh oh!

This comment has been minimized.

vs-mobiletools-engineering-service2 commented Apr 1, 2026

✅ [PR Build #06189b2] Build passed (Detect API changes) ✅

Uh oh!

vs-mobiletools-engineering-service2 commented Apr 1, 2026

✅ API diff for current PR / commit

✅ API diff vs stable

ℹ️ Generator diff

rolfbjarne commented Jan 22, 2026 •

edited

Loading