Skip peer certificate revalidation on resumed TLS sessions by default

src/libraries/System.Net.Http/tests/FunctionalTests/SocketsHttpHandlerTest.cs

@@ -807,6 +807,7 @@ await LoopbackServer.CreateClientAndServerAsync(async uri =>
                 using SocketsHttpHandler handler = CreateSocketsHttpHandler(allowAllCertificates: true);
 
                 handler.Proxy = new UseSpecifiedUriWebProxy(uri, new NetworkCredential("abc", "password"));
+                handler.SslOptions.AllowTlsResume = false;
                 handler.SslOptions.RemoteCertificateValidationCallback = (sender, certificate, chain, error) =>
                 {
                     validationCalled = true;
@@ -5483,7 +5484,10 @@ await LoopbackServerFactory.CreateClientAndServerAsync(
 
         private static void ConfigureSniCallback(HttpClientHandler handler, List<string> sniValues)
         {
-            GetUnderlyingSocketsHttpHandler(handler).SslOptions.RemoteCertificateValidationCallback = (sender, _, _, _) =>
+            SslClientAuthenticationOptions sslOptions = GetUnderlyingSocketsHttpHandler(handler).SslOptions;
+            // Disable TLS session resumption so that cert validation callback fires for every handshake.
+            sslOptions.AllowTlsResume = false;
+            sslOptions.RemoteCertificateValidationCallback = (sender, _, _, _) =>
             {
                 string sni = sender switch
                 {
@@ -6441,6 +6445,7 @@ await LoopbackServerFactory.CreateClientAndServerAsync(async uri =>
                 using HttpClient client = CreateHttpClient(handler);
                 GetUnderlyingSocketsHttpHandler(handler).SslOptions = new SslClientAuthenticationOptions()
                 {
+                    AllowTlsResume = false,
                     RemoteCertificateValidationCallback = delegate { return false; },
                 };
                 using HttpRequestMessage message = new(HttpMethod.Get, uri)

src/libraries/System.Net.Mail/tests/Functional/SmtpClientTlsTest.cs

@@ -144,6 +144,7 @@ public async Task DisableSslServerSupport_NoTls()
         [Fact]
         public async Task AuthenticationException_Propagates()
         {
+            Server.SslOptions.AllowTlsResume = false;
             _serverCertValidationCallback = (cert, chain, errors) =>
             {
                 return false; // force auth errors

src/libraries/System.Net.Security/src/System/Net/Security/LocalAppContextSwitches.cs

@@ -16,6 +16,20 @@ internal static bool DisableTlsResume
             get => GetCachedSwitchValue("System.Net.Security.DisableTlsResume", "DOTNET_SYSTEM_NET_SECURITY_DISABLETLSRESUME", ref s_disableTlsResume);
         }
 
+        // By default the peer certificate is not re-validated on a resumed (abbreviated) TLS
+        // handshake, matching the behavior of common TLS stacks (e.g. OpenSSL, SChannel) that
+        // do not re-run certificate verification when a session is resumed. This optimization
+        // only applies on platforms where session resumption can be detected (currently Windows
+        // and Linux); elsewhere the peer certificate is always re-validated. Enabling this
+        // switch restores the previous behavior of re-validating the peer certificate (running
+        // the chain build and the user validation callback) on every successful resumption.
+        private static int s_revalidateCertificateOnTlsResume;
+        internal static bool RevalidateCertificateOnTlsResume
+        {
+            [MethodImpl(MethodImplOptions.AggressiveInlining)]
+            get => GetCachedSwitchValue("System.Net.Security.RevalidateCertificateOnTlsResume", "DOTNET_SYSTEM_NET_SECURITY_REVALIDATECERTIFICATEONTLSRESUME", ref s_revalidateCertificateOnTlsResume);
+        }
+
         private static int s_captureClientHello;
         internal static bool CaptureClientHello
         {

src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Android.cs

@@ -31,6 +31,12 @@ public void UpdateSslConnectionInfo(SafeSslHandle sslContext)
             // Enum value names should match the cipher suite name, so we just parse the
             string cipherSuite = Interop.AndroidCrypto.SSLStreamGetCipherSuite(sslContext);
             MapCipherSuite(Enum.Parse<TlsCipherSuite>(cipherSuite));
+
+            // The Java/Conscrypt SSLEngine API does not expose a reliable signal for whether the
+            // TLS session was resumed (SSLSession has no isReused()). The only heuristic would be
+            // caching and comparing SSLSession.getId() across the handshake, which is fragile.
+            // Leave TlsResumed as false so that the peer certificate is always revalidated on this
+            // backend, matching the safe fallback.
         }
     }
 }

src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Linux.cs

@@ -28,9 +28,7 @@ public void UpdateSslConnectionInfo(SafeSslHandle sslContext)
             {
                 ApplicationProtocol = alpn.ToArray();
             }
-#if DEBUG
             TlsResumed = Interop.Ssl.SslSessionReused(sslContext);
-#endif
             MapCipherSuite(SslGetCurrentCipherSuite(sslContext));
         }
 

src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.OSX.cs

@@ -57,6 +57,12 @@ private unsafe void UpdateSslConnectionInfoNetworkFramework(SafeDeleteNwContext
             Protocol = (int)protocol;
             TlsCipherSuite = cipherSuite;
             MapCipherSuite(cipherSuite);
+
+            // Network Framework does not expose a public API to determine whether the TLS
+            // session was resumed (sec_protocol_metadata only reports the negotiated protocol,
+            // cipher suite and ALPN; sec_protocol_metadata_get_early_data_accepted covers TLS 1.3
+            // 0-RTT only, not general resumption). Leave TlsResumed as false so that the peer
+            // certificate is always revalidated on this backend, matching the safe fallback.
         }
 
         private void UpdateSslConnectionInfoAppleCrypto(SafeDeleteSslContext context)
@@ -77,6 +83,12 @@ private void UpdateSslConnectionInfoAppleCrypto(SafeDeleteSslContext context)
 
             Protocol = (int)protocol;
             TlsCipherSuite = cipherSuite;
+
+            // SecureTransport does not expose an API to determine whether the session was
+            // resumed that is still present in current Apple SDKs (SSLGetResumableSessionInfo has
+            // been removed), so TlsResumed is left as false here. As with the Network Framework
+            // and Android backends this means the peer certificate is always revalidated on
+            // resumption on this platform, matching the safe fallback.
             if (context.IsServer)
             {
                 if (context.SelectedApplicationProtocol.Protocol.Length > 0)

src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.Windows.cs

@@ -79,15 +79,13 @@ public void UpdateSslConnectionInfo(SafeDeleteContext securityContext)
                 ApplicationProtocol = GetNegotiatedApplicationProtocol(securityContext);
             }
 
-#if DEBUG
             SecPkgContext_SessionInfo info = default;
             TlsResumed = SSPIWrapper.QueryBlittableContextAttributes(
                                     GlobalSSPI.SSPISecureChannel,
                                     securityContext,
                                     Interop.SspiCli.ContextAttribute.SECPKG_ATTR_SESSION_INFO,
                                     ref info) &&
-               ((SecPkgContext_SessionInfo.Flags)info.dwFlags).HasFlag(SecPkgContext_SessionInfo.Flags.SSL_SESSION_RECONNECT);
-#endif
+               (info.dwFlags & (uint)SecPkgContext_SessionInfo.Flags.SSL_SESSION_RECONNECT) != 0;
         }
     }
 }

src/libraries/System.Net.Security/src/System/Net/Security/SslConnectionInfo.cs

@@ -21,8 +21,10 @@ internal partial struct SslConnectionInfo
         public int KeyExchKeySize { get; private set; }
 
         public byte[]? ApplicationProtocol { get; internal set; }
-#if DEBUG
+
+        // Indicates whether the current TLS session was resumed (abbreviated handshake)
+        // rather than negotiated via a full handshake. Used to decide whether the peer
+        // certificate needs to be (re)validated on this connection.
         public bool TlsResumed { get; private set; }
-#endif
     }
 }

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs

@@ -19,6 +19,7 @@ public partial class SslStream
         internal new Stream InnerStream => base.InnerStream;
         private NestedState _nestedAuth;
         private bool _isRenego;
+        private bool _isReAuthentication;
 
         private TlsFrameHelper.TlsFrameInfo _lastFrame;
 
@@ -159,12 +160,14 @@ private async Task ProcessAuthenticationWithTelemetryAsync(bool isAsync, Cancell
         private async Task ReplyOnReAuthenticationAsync<TIOAdapter>(byte[]? buffer, CancellationToken cancellationToken)
             where TIOAdapter : IReadWriteAdapter
         {
+            _isReAuthentication = true;
             try
             {
                 await ForceAuthenticationAsync<TIOAdapter>(receiveFirst: false, buffer, cancellationToken).ConfigureAwait(false);
             }
             finally
             {
+                _isReAuthentication = false;
                 _handshakeWaiter!.SetResult(true);
                 _handshakeWaiter = null;
             }

src/libraries/System.Net.Security/src/System/Net/Security/SslStream.Protocol.cs

@@ -1138,12 +1138,28 @@ internal bool VerifyRemoteCertificate(SslCertificateTrust? trust, ref ProtocolTo
             int preexistingExtraCertsCount = _sslAuthenticationOptions.CertificateChainPolicy?.ExtraStore?.Count ?? 0;
 
             X509Chain? chain = null;
+            bool certificateValidationSkippedOnResume = false;
 
             try
             {
                 X509Certificate2? certificate = CertificateValidationPal.GetRemoteCertificate(_securityContext, ref chain, _sslAuthenticationOptions.CertificateChainPolicy);
 
-                return VerifyRemoteCertificate(certificate, chain, trust, ref alertToken, ref sslPolicyErrors, out chainStatus);
+                return VerifyRemoteCertificateCore(
+                    this,
+                    !_isRenego && !_isReAuthentication,
+                    _sslAuthenticationOptions,
+                    _securityContext,
+                    ref _remoteCertificate,
+                    ref _connectionInfo,
+                    certificate,
+                    chain,
+                    trust,
+                    ref alertToken,
+                    ref sslPolicyErrors,
+                    out chainStatus,
+                    out certificateValidationSkippedOnResume,
+                    peerCertificateChain: null,
+                    cloneCertificateChainPolicy: false);
             }
             finally
             {
@@ -1155,7 +1171,11 @@ internal bool VerifyRemoteCertificate(SslCertificateTrust? trust, ref ProtocolTo
                     // Only cleanup certificates if no user callback was provided.
                     // When a callback is provided, users might add their own certificates to ExtraStore
                     // or keep references to certificates from ChainElements.
-                    if (_sslAuthenticationOptions.CertValidationDelegate == null)
+                    // On a resumed handshake we skip the callback entirely (see the resumption shortcut
+                    // in VerifyRemoteCertificateCore), so nothing else adopts the peer-sent intermediates
+                    // GetRemoteCertificate appended; dispose them here even when a callback is configured
+                    // to avoid leaking X509Certificate2 handles across repeated resumptions.
+                    if (_sslAuthenticationOptions.CertValidationDelegate == null || certificateValidationSkippedOnResume)
                     {
                         // Dispose only the certificates that were added by GetRemoteCertificate
                         for (int i = preexistingExtraCertsCount; i < chain.ChainPolicy.ExtraStore.Count; i++)
@@ -1185,6 +1205,7 @@ internal bool VerifyRemoteCertificate(
         {
             return VerifyRemoteCertificateCore(
                 this,
+                !_isRenego && !_isReAuthentication,
                 _sslAuthenticationOptions,
                 _securityContext,
                 ref _remoteCertificate,
@@ -1195,12 +1216,14 @@ internal bool VerifyRemoteCertificate(
                 ref alertToken,
                 ref sslPolicyErrors,
                 out chainStatus,
+                out _,
                 peerCertificateChain: null,
                 cloneCertificateChainPolicy: false);
         }
 
         internal static bool VerifyRemoteCertificateCore(
             object sender,
+            bool isInitialHandshake,
             SslAuthenticationOptions sslAuthenticationOptions,
 #if TARGET_APPLE
             SafeDeleteContext? securityContext,
@@ -1215,10 +1238,12 @@ internal static bool VerifyRemoteCertificateCore(
             ref ProtocolToken alertToken,
             ref SslPolicyErrors sslPolicyErrors,
             out X509ChainStatusFlags chainStatus,
+            out bool certificateValidationSkippedOnResume,
             X509Certificate2Collection? peerCertificateChain,
             bool cloneCertificateChainPolicy)
         {
             chainStatus = X509ChainStatusFlags.NoError;
+            certificateValidationSkippedOnResume = false;
 
             bool success = false;
 
@@ -1236,6 +1261,34 @@ internal static bool VerifyRemoteCertificateCore(
                 return true;
             }
 
+            if (certificate != null &&
+                isInitialHandshake &&
+                connectionInfo.TlsResumed &&
+                !LocalAppContextSwitches.RevalidateCertificateOnTlsResume)
+            {
+                // The initial TLS handshake was a resumption via an abbreviated handshake. The
+                // peer did not send its certificate again; its identity was established and
+                // validated during the original full handshake that produced the session ticket
+                // / session id. Common TLS stacks (e.g. OpenSSL, SChannel) do not re-run
+                // certificate verification on resumption, so by default neither do we: adopt the
+                // cached peer certificate for the RemoteCertificate property but skip rebuilding
+                // the chain and invoking the user validation callback. Set the
+                // System.Net.Security.RevalidateCertificateOnTlsResume switch to opt back into
+                // re-validating the peer certificate on every resumption.
+                //
+                // This shortcut is gated on the initial handshake: during renegotiation or
+                // TLS 1.3 post-handshake authentication the peer can present a new certificate,
+                // which must always be validated (the identical-certificate case above is handled
+                // separately).
+                remoteCertificateSlot = certificate;
+                certificateValidationSkippedOnResume = true;
+                if (NetEventSource.Log.IsEnabled())
+                {
+                    NetEventSource.Info(sender, "Skipping remote certificate validation on resumed TLS session.");
+                }
+                return true;
+            }
+
             // don't assign to remoteCertificateSlot yet, this prevents weird exceptions if SslStream is disposed in parallel with X509Chain building
 
             if (certificate == null)

src/libraries/System.Net.Security/src/System/Net/Security/TlsSession.cs

@@ -375,6 +375,9 @@ public SslPolicyErrors AcceptWithDefaultValidation()
                 // populated with the same instance.
                 ok = SslStream.VerifyRemoteCertificateCore(
                     this,
+                    // The external certificate is being (re)validated after the handshake, so the
+                    // resumption shortcut in VerifyRemoteCertificateCore must not apply here.
+                    isInitialHandshake: false,
                     _options,
                     _securityContext,
                     ref _remoteCertificate,
@@ -385,6 +388,7 @@ public SslPolicyErrors AcceptWithDefaultValidation()
                     ref alertToken,
                     ref sslPolicyErrors,
                     out _,
+                    out _,
                     _externalRemoteCertificates,
                     cloneCertificateChainPolicy: true);
             }

src/libraries/System.Net.Security/tests/FunctionalTests/CertificateValidationClientServer.cs

@@ -318,6 +318,7 @@ public async Task RemoteCertificateValidationCallback_ExtraStoreCertificates_Not
                     SslClientAuthenticationOptions clientOptions = new SslClientAuthenticationOptions
                     {
                         TargetHost = "localhost",
+                        AllowTlsResume = false,
                         RemoteCertificateValidationCallback = (sender, cert, chain, errors) =>
                         {
                             connectionCount++;