Make HttpSys client certificate behavior consistent

[Tratcher]

Fixes #33586 Now that we know more about the expected usage of the client cert APIs from our work on kestrel, this change brings HttpSys into alignment. The biggest change is that HttpSys' ClientCertificate property used to trigger a sync-over-async renegotiation. In a prior release we made renegotiation opt-in for both the property and the GetClientCertificateAsync method, and this change now removes it entirely for the ClientCertificate property. Anyone that wants renegotiation must opt in and use the GetClientCertificateAsync API. This enables the following usage pattern:

if (feature.ClientCertificate == null)
{
  await BufferRequestBodyAsync();
  await feature.GetClientCertificateAsync();
}

I also borrowed the test certificates from Kestrel so we could enable these tests on the CI.

[BrennanConroy]

In a prior release we made renegotiation opt-in for both the property and the GetClientCertificateAsync method, and this change now removes it entirely for the ClientCertificate property. Anyone that wants renegotiation must opt in and use the GetClientCertificateAsync API.

Does this need an announcement?

[Tratcher]

Announcement draft:

ClientCertificate property no longer triggers renegotiation for HttpSys

The HttpContext.Connection.ClientCertificate property will no longer trigger TLS renegotiations for HttpSys.

Version introduced

6.0

Old behavior

Setting HttpSysOptions.ClientCertificateMethod = ClientCertificateMethod.AllowRenegotation allowed renegotiation to be triggered by both HttpContext.Connection.ClientCertificate and HttpContext.Connection.GetClientCertifiateAsync.

See aspnet/Announcements#422 for related changes in 5.0.

New behavior

Setting HttpSysOptions.ClientCertificateMethod = ClientCertificateMethod.AllowRenegotation will allow renegotiation to be triggered only by HttpContext.Connection.GetClientCertifiateAsync. HttpContext.Connection.ClientCertificate will return the current certificate if available, but will not renegotiate with the client to request one.

Reason for change

When implementing the same features for Kestrel it became clear that applications needed to be able to check the state of the client certificate before triggering a renegotiation. This enables the following usage pattern to deal with issues like the request body conflicting with the renegotiation:

if (connection.ClientCertificate == null)
{
  await BufferRequestBodyAsync();
  await connection.GetClientCertificateAsync();
}

Recommended action

Applications that use delayed client certificate negotiation need to call GetClientCertificateAsync() to trigger that.

Category

ASP.NET

Affected APIs

HttpSysOptions.ClientCertificateMethod
HttpContext.Connection.ClientCertificate
HttpContext.Connection.GetClientCertifiateAsync

---

Issue metadata

• Issue type: breaking-change

[Tratcher]

aspnet/Announcements#466