Add an EventSource to the certificate stack

[davidfowl]

Anywhere we save state to disk (or cert stores) or make outgoing networking calls should be logged in some form. These types of issues are very hard to debug today. Specifically:

• Log any AIA fetches
• Log any OCSP or CRL downloads
• Log any certificate store saves or retrievals

cc @bartonjs @noahfalk

[Dotnet-GitSync-Bot]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq
See info in area-owners.md if you want to be subscribed.

[bartonjs]

AIA/OCSP/CRL fetches are done by the OS on Windows and macOS (and, depending on newer OpenSSL features, future Linux builds).

Similarly, Windows and macOS we have layers on top of the native stores, so lots of store-things can happen that we can't see. We could, of course, log in our wrapper methods.

My concern is that the tracing is really only applicable on one OS.

[davidfowl]

That sounds reasonable if we do nothing there. But we're doing a ton of work on Linux today and it includes swallowing exceptions in a bunch of places as well.

[davidfowl]

This seems like a perfect is the enemy of good issue. Is there logging for other parts of the stack? How would I diagnose this in a production outage? Practically speaking linux is what we care about the most here, that's where we foresee most of our production workloads that need this kind of information.

[noahfalk]

My concern is that the tracing is really only applicable on one OS

If we have different guidance per-OS, one of which says 'turn on this .NET provided logging' and others that say 'go refer to the OS documentation' I think that is a fine outcome. Was that your concern or something else?