System.Security.Cryptography.X509Certificates.Tests fails on Linux

[kotlarmilos]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1167858&view=logs&j=803b4c9b-c8dc-5f8e-c2da-4890c86ff82f&t=b981e634-422d-532f-0103-2cf28078ad75
Build error leg or test failing: X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException

Error Message

Fill the error message using step by step known issues guidance.

{
  "ErrorMessage": "Chain built validly",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException [FAIL]
Precondition: Chain built validly
Stack Trace:
  /_/src/libraries/System.Security.Cryptography/tests/X509Certificates/CollectionTests.cs(909,0): at System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException()
     at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
     at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
  /_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(36,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
  /_/src/libraries/System.Private.CoreLib/src/System/Reflection/RuntimeMethodInfo.cs(126,0): at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator [FAIL]
Precondition: Chain built validly
Stack Trace:
  /_/src/libraries/System.Security.Cryptography/tests/X509Certificates/CollectionTests.cs(1324,0): at System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator()
     at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
     at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
  /_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(36,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
  /_/src/libraries/System.Private.CoreLib/src/System/Reflection/RuntimeMethodInfo.cs(126,0): at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1167858
Error message validated: [Chain built validly]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 10/8/2025 8:19:48 AM UTC

Report

Build	Definition	Test	Pull Request
1208953	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121515
1208670	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException
1207720	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121803
1207702	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121366
1207628	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121796
1207472	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121366
1207126	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121366
1206150	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121515
1205208	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121694
1205190	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121693
1204592	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121678
1204588	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121677
1204581	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121675
1204583	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121676
1204464	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121667
1204450	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121666
1204407	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121663
1204412	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121664
1204146	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121656
1204077	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException
1203804	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1203811	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator
1203210	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121366
1202054	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121407
1203063	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator	#121366
1202993	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1202996	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1202725	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121366
1202920	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121606
1202908	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121515
1201261	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121186
1202617	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1202620	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1202181	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121150
1199208	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121217
1202417	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121591
1202390	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121589
1202381	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121588
2838113	dotnet-runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#54001
1202375	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121587
1202184	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121151
1202085	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator	#119996
1202069	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121563
1202053	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121406
1202056	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121305
1202031	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator	#120330
1201844	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#120330
1201799	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1201781	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#119492
1201775	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#120330
1201766	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1201726	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121316
1201699	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121558
1201675	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121569
1201552	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121537
1201546	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121568
1201535	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121429
1201485	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator	#121555
1201289	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException
1201441	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121558
1201391	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121535
1201347	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121373
1201343	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121562
1201229	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator
2837199	dotnet-runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#54920
1201187	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121513
1201150	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121555
1201146	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#120330
1201108	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#120961
1201054	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121554
1200998	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121535
1200809	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1200897	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#118469
1199782	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121111
1200869	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121334
1200806	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator
1200572	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121479
1200519	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121537
1200707	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException
1200687	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1200645	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121316
1200590	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1200510	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121429
1200406	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121535
1200358	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator	#119432
1200260	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121388
1199543	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.BuildChainCustomTrustStore	#121508
1200274	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121513
1200217	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException
1200224	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException
1200282	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime
1200206	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator
1200220	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator
1200081	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121341
1200059	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#118557
1200056	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#118558
1199742	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#121282
1197086	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.ChainTests.VerifyExpiration_LocalTime	#118957
1199710	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_CopyTo_NonZeroLowerBound_ThrowsIndexOutOfRangeException	#121479
1199672	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.CollectionTests.X509ChainElementCollection_IndexerVsEnumerator	#121468
Displaying 100 of 257 results

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	0	257

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[vcsjones]

Looooooks like something with Azure Linux? Will take a look.

[vcsjones]

Got some "feedback" from CI now that we are logging the chain build error.

Precondition: Chain built validly but failed with 'NotSignatureValid, UntrustedRoot'.

The "UntrustedRoot" is expected. The NotSignatureValid though, is not.

My immediate suspicion is something is disabling RSA + SHA-1 signature validation. Possibly AzSecPack or some other Linux configuration / hardening in CI. That does not quite line up with the frequency of these failures, I would expect these tests to fail much more consistently. But it's a possibility.

[vcsjones]

Does not appear to be Azure Linux specific.

[bartonjs]

The certificate in MicrosoftDotComRootBytes expired on 2025-05-12. We're probably seeing it start to be removed from ca-certificates packages... though I'd expect it to be 100% on a given distro-version, particularly in the queues that use Docker.

[artl93]

@bartonjs - what needs to happen here to get this healthy?