Add mitigations to HttpsClientCert_GetCertInformation flakiness (#1529)

samples/NativeIISSample/Properties/launchSettings.json

@@ -14,8 +14,8 @@
       "commandLineArgs": "$(IISExpressArguments)",
       "environmentVariables": {
         "IIS_SITE_PATH": "$(MSBuildThisFileDirectory)",
-        "ANCM_PATH": "$(AncmPath)",
+        "ANCM_PATH": "$(AspNetCoreModuleV1ShimDll)",
-        "ANCMV2_PATH": "$(AncmV2Path)",
+        "ANCMV2_PATH": "$(AspNetCoreModuleV2ShimDll)",
         "ANCM_OUTOFPROCESS_HANDLER": "$(AspNetCoreModuleV2OutOfProcessHandlerDll)",
         "LAUNCHER_ARGS": "$(TargetPath)",
         "ASPNETCORE_ENVIRONMENT": "Development",
@@ -29,9 +29,9 @@
       "commandLineArgs": "$(IISArguments)",
       "environmentVariables": {
         "IIS_SITE_PATH": "$(MSBuildThisFileDirectory)",
-        "ANCM_PATH": "$(AncmPath)",
+        "ANCM_PATH": "$(AspNetCoreModuleV1ShimDll)",
-        "ANCMV2_PATH": "$(AncmV2Path)",
+        "ANCMV2_PATH": "$(AspNetCoreModuleV2ShimDll)",
-        "ANCM_OUTOFPROCESS_HANDLER": "$(AspNetCoreModuleV2OutOfProcessHandlerDll)",
+        "ASPNETCORE_MODULE_OUTOFPROCESS_HANDLER": "$(AspNetCoreModuleV2OutOfProcessHandlerDll)",
         "LAUNCHER_ARGS": "$(TargetPath)",
         "ASPNETCORE_ENVIRONMENT": "Development",
         "LAUNCHER_PATH": "$(DotNetPath)",

test/Common.FunctionalTests/ClientCertificateFixture.cs

@@ -11,10 +11,9 @@ namespace Microsoft.AspNetCore.Server.IISIntegration.FunctionalTests
     public class ClientCertificateFixture : IDisposable
     {
         private X509Certificate2 _certificate;
+        private const string _certIssuerPrefix = "CN=IISIntegrationTest_Root";
 
-        public X509Certificate2 Certificate
+        public X509Certificate2 GetOrCreateCertificate()
-        {
-            get
         {
             if (_certificate != null)
             {
@@ -24,22 +23,13 @@ namespace Microsoft.AspNetCore.Server.IISIntegration.FunctionalTests
             using (var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine))
             {
                 store.Open(OpenFlags.ReadWrite);
-
-                    foreach (var cert in store.Certificates)
-                    {
-                        if (cert.Issuer != "CN=IISIntegrationTest_Root")
-                        {
-                            continue;
-                        }
-                        _certificate = cert;
-                        store.Close();
-                        return cert;
-                    }
-
                 var parentKey = CreateKeyMaterial(2048);
 
-                    // On first run of the test, creates the certificate in the trusted root certificate authorities.
+                // Create a cert name with a random guid to avoid name conflicts
-                    var parentRequest = new CertificateRequest("CN=IISIntegrationTest_Root", parentKey, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+                var parentRequest = new CertificateRequest(
+                    _certIssuerPrefix + Guid.NewGuid().ToString(),
+                    parentKey, HashAlgorithmName.SHA256,
+                    RSASignaturePadding.Pkcs1);
 
                 parentRequest.CertificateExtensions.Add(
                     new X509BasicConstraintsExtension(
@@ -74,7 +64,6 @@ namespace Microsoft.AspNetCore.Server.IISIntegration.FunctionalTests
                 return imported;
             }
         }
-        }
 
         public void Dispose()
         {
@@ -86,7 +75,17 @@ namespace Microsoft.AspNetCore.Server.IISIntegration.FunctionalTests
             using (var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine))
             {
                 store.Open(OpenFlags.ReadWrite);
-                store.Remove(Certificate);
+                store.Remove(_certificate);
+
+                // Remove any extra certs that were left by previous tests.
+                for (var i = store.Certificates.Count - 1; i >= 0; i--)
+                {
+                    var cert = store.Certificates[i];
+                    if (cert.Issuer.StartsWith(_certIssuerPrefix))
+                    {
+                        store.Remove(cert);
+                    }
+                }
                 store.Close();
             }
         }

test/Common.FunctionalTests/ClientCertificateTests.cs

@@ -1,7 +1,9 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+using System;
 using System.Net.Http;
+using System.Security.Cryptography.X509Certificates;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Server.IIS.FunctionalTests.Utilities;
 using Microsoft.AspNetCore.Server.IISIntegration.FunctionalTests;
@@ -9,6 +11,7 @@ using Microsoft.AspNetCore.Server.IntegrationTesting;
 using Microsoft.AspNetCore.Server.IntegrationTesting.Common;
 using Microsoft.AspNetCore.Server.IntegrationTesting.IIS;
 using Microsoft.AspNetCore.Testing.xunit;
+using Microsoft.Extensions.Logging;
 using Xunit;
 
 namespace Microsoft.AspNetCore.Server.IIS.FunctionalTests
@@ -54,32 +57,52 @@ namespace Microsoft.AspNetCore.Server.IIS.FunctionalTests
             deploymentParameters.ApplicationBaseUriHint = $"https://localhost:{port}/";
             deploymentParameters.AddHttpsToServerConfig();
 
-            var deploymentResult = await DeployAsync(deploymentParameters);
             var handler = new HttpClientHandler
             {
                 ServerCertificateCustomValidationCallback = (a, b, c, d) => true,
                 ClientCertificateOptions = ClientCertificateOption.Manual,
             };
 
+            X509Certificate2 cert = null;
             if (sendClientCert)
             {
-                Assert.NotNull(_certFixture.Certificate);
+                cert = _certFixture.GetOrCreateCertificate();
-                handler.ClientCertificates.Add(_certFixture.Certificate);
+                handler.ClientCertificates.Add(cert);
             }
 
+            var deploymentResult = await DeployAsync(deploymentParameters);
+
             var client = deploymentResult.CreateClient(handler);
             var response = await client.GetAsync("GetClientCert");
 
             var responseText = await response.Content.ReadAsStringAsync();
 
+            try
+            {
                 if (sendClientCert)
                 {
-                Assert.Equal($"Enabled;{_certFixture.Certificate.GetCertHashString()}", responseText);
+                    Assert.Equal($"Enabled;{cert.GetCertHashString()}", responseText);
                 }
                 else
                 {
                     Assert.Equal("Disabled", responseText);
                 }
             }
+            catch (Exception ex)
+            {
+                Logger.LogError($"Certificate is invalid. Issuer name: {cert.Issuer}");
+                using (var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine))
+                {
+                    Logger.LogError($"List of current certificates in root store:");
+                    store.Open(OpenFlags.ReadWrite);
+                    foreach (var otherCert in store.Certificates)
+                    {
+                        Logger.LogError(otherCert.Issuer);
+                    }
+                    store.Close();
+                }
+                throw ex;
+            }
+        }
     }
 }