DisableCertificateDownloads on macOS disables online revocation checking

[vcsjones]

DisableCertificateDownloads, which was introduced in .NET 5, will disable all network operations during chain building on macOS, including CRL and OCSP. On Linux and Windows, this property controls AIA fetching independently from revocation checking.

This appears to be the behavior of SecTrustSetNetworkFetchAllowed and it is my understanding that SecTrustSetNetworkFetchAllowed(..., FALSE) acts as a global on/off for network operations. The documentation isn't quite clear on this and mentions that it only controls AIA fetching, however, this does not seem to be the case. I don't see a way to independently control AIA fetching and online revocation checking.

Even with a complete chain, disabling AIA fetching will result in no revocation checks being performed.

A DynamicRevocationTests test that demonstrates the behavior I am seeing:

[Theory]
[MemberData(nameof(AllViableRevocation))]
public static void RevokeLeafWithAiaFetchingDisabled(PkiOptions pkiOptions)
{
    SimpleTest(
        pkiOptions,
        (root, intermediate, endEntity, holder, responder) =>
        {
            DateTimeOffset now = DateTimeOffset.UtcNow;
            intermediate.Revoke(endEntity, now);
            holder.Chain.ChainPolicy.VerificationTime = now.AddSeconds(1).UtcDateTime;
            holder.Chain.ChainPolicy.DisableCertificateDownloads = true;

            SimpleRevocationBody(
                holder,
                endEntity,
                rootRevoked: false,
                issrRevoked: false,
                leafRevoked: true);
        });
}

This will fail with

Expected: X509ChainStatusFlags[] [NoError, NoError, Revoked]
Actual:   X509ChainStatusFlags[] [NoError, NoError, RevocationStatusUnknown]

Options:

1. Document the behavior of DisableCertificateDownloads on macOS and continue as-is.
2. Change SecTrustChainPal to ignore DisableCertificateDownloads if X509RevocationMode is Online.

Split off from #47492

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[vcsjones]

@bartonjs

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq
See info in area-owners.md if you want to be subscribed.

Issue Details

---

DisableCertificateDownloads, which was introduced in .NET 5, will disable all network operations during chain building on macOS, including CRL and OCSP. On Linux and Windows, this property controls AIA fetching independently from revocation checking.

This appears to be the behavior of SecTrustSetNetworkFetchAllowed and it is my understanding that SecTrustSetNetworkFetchAllowed(..., FALSE) acts as a global on/off for network operations. The documentation isn't quite clear on this and mentions that it only controls AIA fetching, however, this does not seem to be the case. I don't see a way to independently control AIA fetching and online revocation checking.

Even with a complete chain, disabling AIA fetching will result in no revocation checks being performed.

A DynamicRevocationTests test that demonstrates the behavior I am seeing:

[Theory]
[MemberData(nameof(AllViableRevocation))]
public static void RevokeLeafWithAiaFetchingDisabled(PkiOptions pkiOptions)
{
    SimpleTest(
        pkiOptions,
        (root, intermediate, endEntity, holder, responder) =>
        {
            DateTimeOffset now = DateTimeOffset.UtcNow;
            intermediate.Revoke(endEntity, now);
            holder.Chain.ChainPolicy.VerificationTime = now.AddSeconds(1).UtcDateTime;
            holder.Chain.ChainPolicy.DisableCertificateDownloads = true;

            SimpleRevocationBody(
                holder,
                endEntity,
                rootRevoked: false,
                issrRevoked: false,
                leafRevoked: true);
        });
}

This will fail with

Expected: X509ChainStatusFlags[] [NoError, NoError, Revoked]
Actual:   X509ChainStatusFlags[] [NoError, NoError, RevocationStatusUnknown]

Options:

1. Document the behavior of DisableCertificateDownloads on macOS and continue as-is.
2. Change SecTrustChainPal to ignore DisableCertificateDownloads if X509RevocationMode is Online.

Split off from #47492

Author:	vcsjones
Assignees:	-
Labels:	area-System.Security, in pr
Milestone:	-