Repository navigation
[ci-scan] Test failure: System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert #131528
Description
Build Information
Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1526583
Build error leg or test failing: libraries-pgo / System.Net.Security.Tests - System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert
Also observed in runtime-coreclr libraries-jitstress (definition 138).
Error Details
System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert(protocol: Tls12) [FAIL]
Assert.Throws() Failure: No exception was thrown
Expected: typeof(System.Security.Authentication.AuthenticationException)
Stack Trace:
/_/src/libraries/System.Net.Security/tests/FunctionalTests/TlsSessionTests.cs(452,0): at System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert(SslProtocols protocol)
Error Message
{
"ErrorMessage": "SslStreamServer_RejectsClientCert_ClientObservesAlert(protocol: Tls12) [FAIL]",
"ErrorPattern": "",
"BuildRetry": false,
"ExcludeConsoleLog": false
}Note
This issue was generated by the ci-failure-scan Copilot workflow (AI-generated). Verify details before acting.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
awmgmcpg
To allow these domains, add them to the
network.allowedlist in your workflow frontmatter:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
Generated by CI Outer-Loop Failure Scanner · 638.1 AIC · ⌖ 17.1 AIC · ⊞ 18.7K · ◷
Report
Summary
| 24-Hour Hit Count | 7-Day Hit Count | 1-Month Count |
|---|---|---|
| 6 | 25 | 25 |
Activity
dotnet-policy-service commentedon Jul 29, 2026
Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.
github-actions commentedon Jul 30, 2026
Workflow artifact: ci-fix
Artifact kind: handoff
Linked KBE: #131528
Note
AI/Copilot-generated triage note.
This Known Build Error has no producible automated code change (reason: codegen-stress pipeline — the failure reproduces only under
libraries-pgo(def 146) andlibraries-jitstress(def 138), both codegen-stress legs I must not auto-patch), so I could not open even a best-effort PR. Looping in owners so it can be fixed forward rather than muted.Root cause (best analysis)
System.Net.Security.Tests.TlsSessionTests.SslStreamServer_RejectsClientCert_ClientObservesAlert(protocol: Tls12)asserts that a client-cert rejection surfaces as anAuthenticationException, but under the PGO/JITStress legs no exception is thrown (Assert.Throws() Failure: No exception was thrown). The test atsrc/libraries/System.Net.Security/tests/FunctionalTests/TlsSessionTests.cs(452)distinguishes the OpenSSL Tls12 "reject mid-handshake" path (inHandshake) from the SChannel/TLS1.3 "alert on first encrypted I/O" path. On the PGO/JITStress legs the handshake timing appears to shift so the expected mid-handshake rejection does not materialize within the assertion window. Because it only reproduces under codegen stress, the correct fix (test-timing hardening vs. a genuine stress-only handshake regression) is a networking + codegen judgment call, not a mechanical edit.Evidence
Suggested reviewers / area contacts
area-System.Net.Security):@karelz,@bartonjs,@vcsjones,@dotnet/nclA fix would likely involve confirming whether this is a stress-only handshake-timing artifact (harden the test's wait/assert for the mid-handshake reject path) or a real regression in client-cert alert surfacing under optimized codegen.
Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
awmgmcpgSee Network Configuration for more information.
wfurt commentedon Aug 4, 2026
duplicate of #131330