Detect ephemeral client cert key via SEC_E_UNKNOWN_CREDENTIALS in QUIC - #132832
Merged
Conversation
Schannel reports SEC_E_NO_CREDENTIALS (QUIC_STATUS_CERT_NO_CERT, 0x8009030E)
for server certificates but SEC_E_UNKNOWN_CREDENTIALS (0x8009030D) for client
certificates when the private key is ephemeral. The ephemeral-key diagnostic in
MsQuicConfiguration only matched QUIC_STATUS_CERT_NO_CERT, so the client-cert
case surfaced a raw QuicException ("ConfigurationLoadCredential failed:
Unknown (0x8009030d)") instead of the expected AuthenticationException with the
"ephemeral" message, breaking Client_CertificateWithEphemeralKey_Throws.
Broaden the status check to also handle SEC_E_UNKNOWN_CREDENTIALS. The block
remains gated by HasPrivateKey()/HasEphemeralPrivateKey, so non-ephemeral
failures are unaffected.
Fixes #132831
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @karelz, @dotnet/ncl |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the Windows Schannel-specific error handling in System.Net.Quic configuration creation so that client certificates with ephemeral private keys are detected consistently and reported via the existing AuthenticationException path instead of surfacing a raw QuicException status.
Changes:
- Extends the ephemeral-private-key diagnostic guard to also trigger when
ConfigurationLoadCredentialfails withSEC_E_UNKNOWN_CREDENTIALS(in addition to the existingQUIC_STATUS_CERT_NO_CERT/SEC_E_NO_CREDENTIALScase). - Adds clarifying comments documenting the server-vs-client Schannel status difference for ephemeral keys.
This was referenced Aug 27, 2026
wfurt
approved these changes
Aug 28, 2026
Member
|
/ba-g test failures unrelated |
Member
Author
|
/backport to release/10.0 |
Contributor
|
Started backporting to |
Member
Author
|
/backport to release/11.0 |
Contributor
|
Started backporting to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
System.Net.Quic.Tests.MsQuicTests.Client_CertificateWithEphemeralKey_Throwsstarted failing in CI with a raw:instead of the expected
AuthenticationExceptionwhose message contains "ephemeral".Root cause
The Windows ephemeral-key diagnostic in
MsQuicConfigurationonly triggers when the native status equalsQUIC_STATUS_CERT_NO_CERT, which on Windows maps toSEC_E_NO_CREDENTIALS(0x8009030E). Schannel returns that status for server certificates, but for client certificates with an ephemeral private key it now returnsSEC_E_UNKNOWN_CREDENTIALS(0x8009030D). Because the guard did not match0x8009030D, the ephemeral check was skipped andThrowHelper.ThrowIfMsQuicErrorsurfaced the rawQuicException(GetErrorMessageForStatushas no name for0x8009030D, hence theUnknown (0x8009030d)text). The server-side test still returns0x8009030E, which is why only the client test regressed.Fix
Broaden the status check to also handle
SEC_E_UNKNOWN_CREDENTIALS, reusing the existingInterop.SECURITY_STATUScast pattern already used a few lines above forAlgorithmMismatch. The block remains gated bycertificate.HasPrivateKey()andsafeCertContextHandle.HasEphemeralPrivateKey, so any non-ephemeralUnknownCredentialsfailure falls through toThrowIfMsQuicErrorunchanged. No false positives.The existing
Client_CertificateWithEphemeralKey_Throwstest is the regression coverage, so no new test is added.Notes
SslStream(SslStreamPal.Windows.AcquireCredentialsHandle) has an analogous handler that catches onlyNoCredentials; it is a separate, non-failing code path and intentionally left out of this change.0x8009030Dvs0x8009030Ebehavior is dependent on the Windows/Schannel version, so this is validated by CI rather than local runs.Fixes: #132831
Note
This pull request was authored by GitHub Copilot.