[iOS] System.PlatformNotSupportedException: The PKCS#12 Exportable flag is not supported on this platform.

[vitek-karas]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1084860

Build error leg or test failing: System.Net.WebSockets.Client.Tests

Affected CI jobs: runtime-extra-platforms iossimulator_arm64_release_allsubsets_mono, iossimulator_x64_release_allsubsets_mono, tvossimulator_x64_release_allsubsets_mono, maccatalyst_arm64_release_allsubsets_mono, maccatalyst_x64_release_allsubsets_mono, tvos_arm64_release_allsubsets_mono

Commit range: 5392448...27c8fe0

Extracted Error Log

The failure is an assert which is caused by an exception System.PlatformNotSupportedException: The PKCS#12 Exportable flag is not supported on this platform. in a type static constructor System.Net.Test.Common.Configuration.Certificates..cctor().

The last successful test is:

[PASS] System.Net.WebSockets.Client.Tests.HttpClientConnectTest_Http2.ConnectAsync_VersionNotSupported_WithSsl_Throws

Then the tests fail with an assert. On iossimulator_arm64_release_allsubsets_mono, iossimulator_x64_release_allsubsets_mono or tvossimulator_x64_release_allsubsets_mono the failure is reported as either exit code -4 or 80 and the failure is just a process termination without additional details.

[07:24:01] dbug: 2025-07-03 07:24:01.194285-0400 System.Net.WebSockets.Client.Tests[26688:522535] ((null) warning) Process terminated. Assertion Failed

On maccatalyst_arm64_release_allsubsets_mono or maccatalyst_x64_release_allsubsets_mono the failure is also a process termination caused by an assert, but this time it prints out detailed error information:

[06:29:29] dbug: 2025-07-03 06:29:19.475 Db System.Net.WebSockets.Client.Tests[1575:3e14] ---- DEBUG ASSERTION FAILED ----
[06:29:29] dbug: ---- Assert Short Message ----
[06:29:29] dbug: Certificates cctor threw System.PlatformNotSupportedException: The PKCS#12 Exportable flag is not supported on this platform.
[06:29:29] dbug: at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ValidatePlatformKeyStorageFlags(X509KeyStorageFlags keyStorageFlags)
[06:29:29] dbug: at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ValidateKeyStorageFlagsCore(X509KeyStorageFlags keyStorageFlags)
[06:29:29] dbug: at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
[06:29:29] dbug: at System.Net.Test.Common.Configuration.Certificates..cctor()

Sample log: https://helixr1107v0xdeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-heads-main-849fee325571405aa8/System.Net.WebSockets.Client.Tests.Attempt.3/1/console.27cf4bc9.log?helixlogtype=result

On tvos_arm64_release_allsubsets_mono the failure seems to be caused by the same exception (based on the fact that the test fails in the same spot and with an assert as well), instead an assert in mono JIT is reported:

[18:18:45] dbug: [18:18:08.3777240] 	  at System.Environment:FailFast <0x00007>
[18:18:45] dbug: [18:18:08.3777290] * Assertion at /Users/runner/work/1/s/src/mono/mono/metadata/jit-info.c:918, condition `!ji->async' not met

There's a lengthy callstack reported as well which seems to point to a Trace.Fail in a class constructor. See this log for more details: https://helixr1107v0xdeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-heads-main-0040104448894463a9/System.Net.WebSockets.Client.Tests.Attempt.3/1/console.c9ca89cc.log?helixlogtype=result

Starting with build 20250625.2 the failure is 100% repro on all iOS, maccatalyst or tvOS devices and simulators across both x64 and arm64 architectures.

Error Message

{
  "ErrorMessage": ["ConnectAsync_VersionNotSupported_WithSsl_Throws", "Assertion Failed"],
  "BuildRetry": true,
  "ExcludeConsoleLog": false
}

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1084860
Error message validated: [ConnectAsync_VersionNotSupported_WithSsl_Throws Assertion Failed]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 7/3/2025 10:10:25 PM UTC

Report

Build	Definition	Test	Pull Request
1090889	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1090290	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1089548	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1088858	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1088075	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1087569	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1086936	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1086696	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1086435	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1086311	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1086189	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1085900	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution
1084860	dotnet/runtime	System.Net.WebSockets.Client.Tests.WorkItemExecution

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
1	12	13

[dotnet-policy-service]

Tagging subscribers to 'os-ios': @vitek-karas, @kotlarmilos, @ivanpovazan, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'os-maccatalyst': @vitek-karas, @kotlarmilos, @ivanpovazan, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'os-tvos': @vitek-karas, @kotlarmilos, @ivanpovazan, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

[vitek-karas]

I think there are two problems in this issue:

The PlatformNotSupportedException

It seems to be the root cause of the failure itself. What is not clear is what caused it to start happening, the commit range doesn't seem to contain anything interesting.

The assertion and the variety of failure modes

The exception seems to cause a managed assert (Debug.Assert) which is not exactly expected, especially on release build - so there's something weird happening here.
Additionally, the process is then terminated in different ways depending on the platform. In such case I would expect the behavior shown on maccatalyst, where it correctly reports the managed callstack and terminates the process. On iOS-like devices there's no managed callstack (or native one), it just reports assertion failure - not ideal. On tvOS devices it actually causes an assert in the JIT, which is even weirder.

[vitek-karas]

@ManickaP would you know who is the best person to look into the exception (and why it started happening):

[06:29:29] dbug: Certificates cctor threw System.PlatformNotSupportedException: The PKCS#12 Exportable flag is not supported on this platform.
[06:29:29] dbug: at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ValidatePlatformKeyStorageFlags(X509KeyStorageFlags keyStorageFlags)
[06:29:29] dbug: at System.Security.Cryptography.X509Certificates.X509CertificateLoader.ValidateKeyStorageFlagsCore(X509KeyStorageFlags keyStorageFlags)
[06:29:29] dbug: at System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(Byte[] data, String password, X509KeyStorageFlags keyStorageFlags, Pkcs12LoaderLimits loaderLimits)
[06:29:29] dbug: at System.Net.Test.Common.Configuration.Certificates..cctor()

The question is not why we're not supporting specific crypto on iOS-like targets, it's more why the networking tests started to fail on it recently (6/25).

[ManickaP]

@rzikm @wfurt Any ideas here?

[ManickaP]

Also pinging @CarnaViire, this PR #116817 corresponds to the breakage time-wise.

[rzikm]

#116817 seems to be the cause.

The new test hardcodes UseSsl = true

runtime/src/libraries/System.Net.WebSockets.Client/tests/ConnectTest.Http2.cs

Lines 247 to 270 in 0382bef

	[Fact]
	[SkipOnPlatform(TestPlatforms.Browser, "System.Net.Sockets is not supported on this platform")]
	public async Task ConnectAsync_Http11WithRequestVersionOrHigher_Loopback_Success()
	{
	await LoopbackServer.CreateServerAsync(async (server, url) =>
	{
	using (var cws = new ClientWebSocket())
	using (var cts = new CancellationTokenSource(TimeOutMilliseconds))
	{
	cws.Options.HttpVersion = HttpVersion.Version11;
	cws.Options.HttpVersionPolicy = HttpVersionPolicy.RequestVersionOrHigher;
	Task connectTask = cws.ConnectAsync(url, GetInvoker(), cts.Token);
	await server.AcceptConnectionAsync(async connection =>
	{
	await LoopbackHelper.WebSocketHandshakeAsync(connection);
	});
	await connectTask;
	Assert.Equal(WebSocketState.Open, cws.State);
	}
	}, new LoopbackServer.Options { UseSsl = true, WebSocketEndpoint = true });
	}

Which then causes the test to attempt to load certs from the files and fail.

Btw. the UseSsl seems to default to true on platforms that seem to support it

runtime/src/libraries/Common/tests/System/Net/Http/GenericLoopbackServer.cs

Line 179 in 4aa5460

public bool UseSsl { get; set; } = PlatformDetection.SupportsAlpn && !Capability.Http2ForceUnencryptedLoopback();

(IOS is not one of them)

runtime/src/libraries/Common/tests/TestUtilities/System/PlatformDetection.cs

Lines 312 to 340 in 72a5ef7

	private static bool GetAlpnSupport()
	{
	if (IsWindows && !IsWindows7 && !IsNetFramework)
	{
	return true;
	}
	if (IsOpenSslSupported)
	{
	if (OpenSslVersion.Major >= 3)
	{
	return true;
	}
	return OpenSslVersion.Major == 1 && (OpenSslVersion.Minor >= 1 || OpenSslVersion.Build >= 2);
	}
	if (IsAndroid)
	{
	return Interop.AndroidCrypto.SSLSupportsApplicationProtocolsConfiguration();
	}
	if (IsOSX)
	{
	return true;
	}
	return false;
	}

I don't know if the tests can be made to work by not specifying the Exportable flag to the certs on iOS, but I would expect the answer to be "no".

Since the test does not seem to rely on TLS, we should just remove the explicit UseSsl value

[wfurt]

That is curious @rzikm. iOS should imho fall-back to same bucket as macOS as far as ALPN support. I feel the answer is somewhere else e.g. we should figure out what we need the exportable flag.