[ci-scan] Test failure: System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCert [Content truncated due to length]

[github-actions]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1582322
Build error leg or test failing: android-arm64 Release AllSubsets_CoreCLR - System.Security.Cryptography.Tests

KBE authoring guidance (ci-failure-scan)

• Error Details is for readers. Paste the full exception, stack trace, or build error excerpt so the failure is understandable without opening the raw log.
• Build Analysis parses only the single JSON block under Error Message.
• ErrorMessage is a case-sensitive ordinal String.Contains substring copied verbatim from the failing log.
• Set BuildRetry to true only for a clear infrastructure retry case. ExcludeConsoleLog disables Helix console-log scanning.

Error Details

System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate fails on Android (android-arm64, android-arm) in runtime-extra-platforms for both revocationMode: NoCheck and revocationMode: Online. The chain build does not surface the expected NotTimeValid status for an expired self-signed certificate.

1) [FAIL] System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate   Test name: ...BuildChainForExpiredSelfSignedCertificate(revocationMode: NoCheck)
   Assembly:  [System.Security.Cryptography.Tests, Version=11.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51]
   Exception messages: NotTimeValid should be set; status flags: NoError
   Exception stack traces:    at System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate(X509RevocationMode revocationMode)

2) [FAIL] ...BuildChainForExpiredSelfSignedCertificate(revocationMode: Online)
   Exception messages: NotTimeValid should be set; status flags: NoError

Observed in builds 1582322 (finished 2026-09-04) and 1584171 (finished 2026-09-05), on android-arm64 and android-arm legs.

Error Message

{
  "ErrorMessage": [
    "[FAIL] System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate",
    "NotTimeValid should be set; status flags: NoError"
  ],
  "ErrorPattern": "",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Agentic workflow metadata (ci-failure-scan)

Workflow artifact: ci-failure-scan
Artifact kind: kbe-verification
Verified match count: 2 hits in failure.log

---

Filed by ci-failure-scan (detection only). ci-failure-fix walks open [ci-scan] KBEs and either opens a small fix PR or comments here to loop in owners — it never disables the test.

Generated by CI Outer-Loop Failure Scanner · opus48 · 990.8 AIC · ⌖ 13.1 AIC · ⊞ 20.7K · ◷

Report

Build	Repository	Test	Pull Request
1588425	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1586642	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1585080	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate
1584749	dotnet/runtime	System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
1	4	4

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'arch-android': @vitek-karas, @simonrozsival, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.