Don't use IgnoreRootRevocationUnknown when processing intermediate CA re-key certificates

[bartonjs]

This change ends up with a lot of test infra boilerplate to let DynamicRevocationTests work with a 4-chain instead of a 3-chain, and to specify the names of the certificates to build the re-key state.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[Copilot]

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates Unix certificate-chain verification so signed self-issued re-key certificates are treated as intermediates for revocation suppression.

Changes:

• Determines root status by chain position and partial-chain state.
• Adds four-certificate PKI test infrastructure and regression tests.
• Adds distinguished-name overloads to certificate helpers.

File summaries

File	Description
src/libraries/System.Security.Cryptography/tests/X509Certificates/RevocationTests/DynamicRevocationTests.cs	Updated as part of this pull request.
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/UnixChainVerifier.cs	Updated as part of this pull request.
src/libraries/Common/tests/System/Security/Cryptography/X509Certificates/CertificateAuthority.cs	Updated as part of this pull request.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Address the Android revocation-status test failure and add coverage for the partial-chain branch.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/UnixChainVerifier.cs:13

• Please add coverage for the new partial-chain branch. The added tests always provide a custom root and assert a complete four-element chain, so rootIndex = -1 is never exercised; a self-issued, differently-keyed CA at the top of an incomplete chain could therefore regress to being treated as a root without any test detecting that IgnoreRootRevocationUnknown must not suppress its unknown revocation status. The existing AIA partial-chain tests only use RevocationMode.NoCheck (RevocationTests/AiaTests.cs:48-51).

            int rootIndex = HasPartialChain(chainElements) ? -1 : chainElements.Length - 1;

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

[bartonjs]

/azp run runtime-libraries-coreclr outerloop

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

🔵 Needs a closer look

One or more issues must be addressed before approval.

Review details

Suppressed comments (2)

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/X509Certificates/UnixChainVerifier.cs:13

• HasPartialChain changes the suppression classification for every chain containing a PartialChain status, but the new tests only exercise the complete four-element chain. The existing partial-chain tests do not combine that path with revocation verification flags, so a regression in the new rootIndex = -1 branch would go unnoticed. Please add a partial-chain case that verifies the root and CA ignore flags separately.

            int rootIndex = HasPartialChain(chainElements) ? -1 : chainElements.Length - 1;

src/libraries/System.Security.Cryptography/tests/X509Certificates/RevocationTests/DynamicRevocationTests.cs:1258

• The Android-specific expectation below is unreachable because [PlatformSpecific(TestPlatforms.Linux)] excludes Android, so the shared ChainPal.Android path is not regression-tested by these new cases. Either include Android if this dynamic responder setup is supported there, or remove the dead branch and add separate Android coverage.

        [Fact]
        [PlatformSpecific(TestPlatforms.Linux)]
        public static void SelfIssuedButNotSelfSignedRevocationUnknown_IgnoreIntermediateUnknown()

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved issues were identified that would block approval.

Review effort: Lite
Findings: None