Skip to content

Add breaking change documentation for SSL certificate revocation check mode change in .NET 10 #46928

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

Copilot
Copy link
Contributor

@Copilot Copilot AI commented Jun 23, 2025

This PR adds comprehensive documentation for the breaking change where HttpClient and SslStream default certificate revocation check mode changed from NoCheck to Online in .NET 10 Preview 6.

Changes Made

  • Created new breaking change document: docs/core/compatibility/networking/10.0/ssl-certificate-revocation-check-default.md

    • Follows the official breaking change template structure
    • Includes clear before/after code examples
    • Provides multiple recommended actions including AppContext switches
    • Documents all affected APIs with proper xref links
  • Updated TOC: Added the new document to both "By version" and "By area" sections in docs/core/compatibility/toc.yml

  • Updated index: Added entry to the Networking section table in docs/core/compatibility/10.0.md

Breaking Change Details

The default values for SslClientAuthenticationOptions.CertificateRevocationCheckMode and SslServerAuthenticationOptions.CertificateRevocationCheckMode have changed from NoCheck to Online. This enhances security and makes behavior consistent with X509ChainPolicy.

Affected APIs:

  • SslStream.AuthenticateAsClient* methods
  • SslStream.AuthenticateAsServer* methods
  • HttpClient (all Send* methods when using WinHttpHandler or SocketsHttpClientHandler)

Migration path:

// To preserve previous behavior
var clientOptions = new SslClientAuthenticationOptions
{
    TargetHost = "example.com",
    CertificateRevocationCheckMode = X509RevocationMode.NoCheck
};

Alternatively, use the System.Net.Security.NoRevocationCheckByDefault AppContext switch or DOTNET_SYSTEM_NET_SECURITY_NOREVOCATIONCHECKBYDEFAULT environment variable.

Fixes #46824.


💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.


Internal previews

📄 File 🔗 Preview link
docs/core/compatibility/10.0.md docs/core/compatibility/10.0
docs/core/compatibility/networking/10.0/ssl-certificate-revocation-check-default.md docs/core/compatibility/networking/10.0/ssl-certificate-revocation-check-default
docs/core/compatibility/toc.yml docs/core/compatibility/toc

@Copilot Copilot AI changed the title [WIP] [Breaking change]: HttpClient/SslStream default certificate revocation check mode changed to Online Add breaking change documentation for SSL certificate revocation check mode change in .NET 10 Jun 23, 2025
@Copilot Copilot AI requested a review from gewarren June 23, 2025 18:11
Copilot finished work on behalf of gewarren June 23, 2025 18:11
@gewarren gewarren requested a review from rzikm June 24, 2025 09:54
@gewarren gewarren marked this pull request as ready for review June 24, 2025 09:54
@gewarren gewarren requested a review from a team as a code owner June 24, 2025 09:54
Copy link
Member

@rzikm rzikm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some nits and minor wording change recommendations, I leave final language review to @gewarren

@Copilot Copilot AI requested a review from rzikm June 24, 2025 10:28
Copilot finished work on behalf of rzikm June 24, 2025 10:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Breaking change]: HttpClient/SslStream default certificate revocation check mode changed to Online
3 participants