[ci-scan] Test failure: System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCert [Content truncated due to length]

[github-actions]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1582322
Build error leg or test failing: android-arm64 Release AllSubsets_CoreCLR - System.Security.Cryptography.Tests

KBE authoring guidance (ci-failure-scan)

• Error Details is for readers. Paste the full exception, stack trace, or build error excerpt so the failure is understandable without opening the raw log.
• Build Analysis parses only the single JSON block under Error Message.
• ErrorMessage is a case-sensitive ordinal String.Contains substring copied verbatim from the failing log.
• Set BuildRetry to true only for a clear infrastructure retry case. ExcludeConsoleLog disables Helix console-log scanning.

Error Details

System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate fails on Android (android-arm64, android-arm) in runtime-extra-platforms for both revocationMode: NoCheck and revocationMode: Online. The chain build does not surface the expected NotTimeValid status for an expired self-signed certificate.

1) [FAIL] System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate   Test name: ...BuildChainForExpiredSelfSignedCertificate(revocationMode: NoCheck)
   Assembly:  [System.Security.Cryptography.Tests, Version=11.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51]
   Exception messages: NotTimeValid should be set; status flags: NoError
   Exception stack traces:    at System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate(X509RevocationMode revocationMode)

2) [FAIL] ...BuildChainForExpiredSelfSignedCertificate(revocationMode: Online)
   Exception messages: NotTimeValid should be set; status flags: NoError

Observed in builds 1582322 (finished 2026-09-04) and 1584171 (finished 2026-09-05), on android-arm64 and android-arm legs.

Error Message

{
  "ErrorMessage": [
    "[FAIL] System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate",
    "NotTimeValid should be set; status flags: NoError"
  ],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Agentic workflow metadata (ci-failure-scan)

Workflow artifact: ci-failure-scan
Artifact kind: kbe-verification
Verified match count: 2 hits in failure.log

---

Filed by ci-failure-scan (detection only). ci-failure-fix walks open [ci-scan] KBEs and either opens a small fix PR or comments here to loop in owners — it never disables the test.

Generated by CI Outer-Loop Failure Scanner · opus48 · 990.8 AIC · ⌖ 13.1 AIC · ⊞ 20.7K · ◷

Report

Build	Repository	Test	Pull Request
1625894	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1624450	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1622443	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1622039	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1620717	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1619076	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1617850	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate	#134549
1617342	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1615702	dotnet/runtime	System.Security.Cryptography.Tests.ChaCha20Poly1305Tests.EncryptTamperAADDecrypt
1615485	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate	#134819
1614142	dotnet/runtime	System.Security.Cryptography.Tests.HpkeImplementationTests.SingleShot_Roundtrip
1613653	dotnet/runtime	System.Security.Cryptography.Tests.HpkeImplementationTests.SingleShot_Roundtrip_EmptyAadAndInfo
1613174	dotnet/runtime	System.Security.Cryptography.Tests.HpkeImplementationTests.SingleShot_Roundtrip
1612276	dotnet/runtime	System.Security.Cryptography.Tests.WorkItemExecution	#133197
1611740	dotnet/runtime	System.Security.Cryptography.Tests.HpkeImplementationTests.SingleShot_Roundtrip
1610154	dotnet/runtime	System.Security.Cryptography.Tests.HpkeImplementationTests.SingleShot_Roundtrip
1608288	dotnet/runtime	System.Security.Cryptography.Tests.HpkeImplementationTests.SingleShot_Roundtrip_EmptyAadAndInfo
1606626	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1602914	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate	#134060
1604459	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1603402	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1601987	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1601683	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate	#133828
1600403	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1598688	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1596986	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1594919	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1594486	dotnet/runtime	System.Security.Cryptography.Tests.WorkItemExecution
1593920	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1592042	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1590326	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1588425	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	5	32

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'arch-android': @vitek-karas, @simonrozsival, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

[github-actions]

Workflow artifact: ci-fix
Artifact kind: handoff
Linked KBE: #133314

Note

AI/Copilot-generated triage note.

This Known Build Error has no producible automated code change (reason: platform X.509 chain-building behavior — a security-area-owner decision), so I could not open a best-effort PR without guessing intent. Looping in owners rather than muting.

Root cause (best analysis)

On Android (android-arm64, android-arm) AllSubsets_CoreCLR, DynamicChainTests.BuildChainForExpiredSelfSignedCertificate fails for both revocationMode: NoCheck and Online: building a chain for an expired self-signed certificate does not surface the expected X509ChainStatusFlags.NotTimeValid — the status flags come back NoError. The Android chain-building backend does not report NotTimeValid for an expired self-signed cert the way the test expects. Whether the fix is in the Android X.509 chain interop (to surface NotTimeValid) or a platform-specific test expectation is a security-area-owner decision, so I am not guessing an expectation change.

Evidence

• Failing build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1582322
• First build it occurred: source build 1582322 (within the scanned window; may not be the true origin)
• Possible related PR: none identified with sufficient confidence

Suggested reviewers / area contacts

• Area owners (area-System.Security): @bartonjs, @dotnet/area-system-security

A fix likely involves the Android X.509 chain-building interop reporting NotTimeValid for expired self-signed certificates, or an owner-approved platform-specific expectation adjustment.

Structured data:

{
  "artifact_kind": "handoff",
  "linked_kbe": 133314,
  "workflow_artifact": "ci-fix"
}

Generated by CI Outer-Loop Failure Fixer · opus48 · 444.8 AIC · ⌖ 28.9 AIC · ⊞ 19.6K · ◷