DisableCertificateDownloads, which was introduced in .NET 5, will disable all network operations during chain building on macOS, including CRL and OCSP. On Linux and Windows, this property controls AIA fetching independently from revocation checking.
This appears to be the behavior of SecTrustSetNetworkFetchAllowed and it is my understanding that SecTrustSetNetworkFetchAllowed(..., FALSE) acts as a global on/off for network operations. The documentation isn't quite clear on this and mentions that it only controls AIA fetching, however, this does not seem to be the case. I don't see a way to independently control AIA fetching and online revocation checking.
Even with a complete chain, disabling AIA fetching will result in no revocation checks being performed.
A DynamicRevocationTests test that demonstrates the behavior I am seeing:
[Theory]
[MemberData(nameof(AllViableRevocation))]
public static void RevokeLeafWithAiaFetchingDisabled(PkiOptions pkiOptions)
{
SimpleTest(
pkiOptions,
(root, intermediate, endEntity, holder, responder) =>
{
DateTimeOffset now = DateTimeOffset.UtcNow;
intermediate.Revoke(endEntity, now);
holder.Chain.ChainPolicy.VerificationTime = now.AddSeconds(1).UtcDateTime;
holder.Chain.ChainPolicy.DisableCertificateDownloads = true;
SimpleRevocationBody(
holder,
endEntity,
rootRevoked: false,
issrRevoked: false,
leafRevoked: true);
});
}This will fail with
Expected: X509ChainStatusFlags[] [NoError, NoError, Revoked]
Actual: X509ChainStatusFlags[] [NoError, NoError, RevocationStatusUnknown]
Options:
- Document the behavior of
DisableCertificateDownloads on macOS and continue as-is.
- Change
SecTrustChainPal to ignore DisableCertificateDownloads if X509RevocationMode is Online.
Split off from #47492
DisableCertificateDownloads, which was introduced in .NET 5, will disable all network operations during chain building on macOS, including CRL and OCSP. On Linux and Windows, this property controls AIA fetching independently from revocation checking.This appears to be the behavior of
SecTrustSetNetworkFetchAllowedand it is my understanding thatSecTrustSetNetworkFetchAllowed(..., FALSE)acts as a global on/off for network operations. The documentation isn't quite clear on this and mentions that it only controls AIA fetching, however, this does not seem to be the case. I don't see a way to independently control AIA fetching and online revocation checking.Even with a complete chain, disabling AIA fetching will result in no revocation checks being performed.
A
DynamicRevocationTeststest that demonstrates the behavior I am seeing:This will fail with
Options:
DisableCertificateDownloadson macOS and continue as-is.SecTrustChainPalto ignoreDisableCertificateDownloadsifX509RevocationModeisOnline.Split off from #47492