diff --git a/.openpublishing.redirection.core.json b/.openpublishing.redirection.core.json index 0d7c6c2bb6c3a..7297db8b7c105 100644 --- a/.openpublishing.redirection.core.json +++ b/.openpublishing.redirection.core.json @@ -179,6 +179,10 @@ "source_path_from_root": "/docs/core/compatibility/networking.md", "redirect_url": "/dotnet/core/compatibility/3.0" }, + { + "source_path_from_root": "/docs/core/compatibility/networking/10.0/ssl-certificate-revocation-check-default.md", + "redirect_url": "/dotnet/core/compatibility/10.0" + }, { "source_path_from_root": "/docs/core/compatibility/networking/7.0/connectasync-argumentexception.md", "redirect_url": "/dotnet/core/compatibility/7.0" diff --git a/docs/core/compatibility/10.0.md b/docs/core/compatibility/10.0.md index 8cb077face469..7d0c66625293f 100644 --- a/docs/core/compatibility/10.0.md +++ b/docs/core/compatibility/10.0.md @@ -97,7 +97,6 @@ If you're migrating an app to .NET 10, the breaking changes listed here might af | Title | Type of change | Introduced version | |-------|-------------------|--------------------| | [HTTP/3 support disabled by default with PublishTrimmed](networking/10.0/http3-disabled-with-publishtrimmed.md) | Source incompatible | Preview 6 | -| [HttpClient/SslStream default certificate revocation check mode changed to Online](networking/10.0/ssl-certificate-revocation-check-default.md) | Behavioral change | Preview 6 | | [Streaming HTTP responses enabled by default in browser HTTP clients](networking/10.0/default-http-streaming.md) | Behavioral change | Preview 3 | | [`Uri` length limits removed](networking/10.0/uri-length-limits-removed.md) | Behavioral change | Preview 7 | diff --git a/docs/core/compatibility/networking/10.0/ssl-certificate-revocation-check-default.md b/docs/core/compatibility/networking/10.0/ssl-certificate-revocation-check-default.md deleted file mode 100644 index fc2e5857e0a3e..0000000000000 --- a/docs/core/compatibility/networking/10.0/ssl-certificate-revocation-check-default.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: "Breaking change - HttpClient/SslStream default certificate revocation check mode changed to Online" -description: "Learn about the breaking change in .NET 10 where the default certificate revocation check mode changed from 'NoCheck' to 'Online'." -ms.date: 06/23/2025 -ai-usage: ai-assisted -ms.custom: https://github.com/dotnet/docs/issues/46824 ---- - -# HttpClient/SslStream default certificate revocation check mode changed to `Online` - -The default values of and have changed from `NoCheck` to `Online`. - -The default values of and have changed from `false` to `true`. - -This change enhances security and makes the behavior consistent with . - -## Version introduced - -.NET 10 Preview 6 - -## Previous behavior - -Previously, the default values of and were , and the default values of and were `false`, meaning revocation status of peer certificates wasn't checked by default. - -## New behavior - -Starting in .NET 10, the default values of and are , and the default values of and are `true`, meaning revocation status of peer certificates are checked online by default. - -## Type of breaking change - -This change is a [behavioral change](../../categories.md#behavioral-change). - -## Reason for change - -This change enhances security and ensures consistency between APIs related to X.509 certificate revocation checking. - -## Recommended action - -If certificate revocation checking is not desired and you are using directly, specify explicitly: - -```csharp -var clientOptions = new SslClientAuthenticationOptions -{ - TargetHost = "example.com", - CertificateRevocationCheckMode = X509RevocationMode.NoCheck -}; - -var serverOptions = new SslServerAuthenticationOptions -{ - ServerCertificate = serverCertificate, - CertificateRevocationCheckMode = X509RevocationMode.NoCheck -}; -``` - -When using you need to configure the underlying handler during creation: - -```csharp -var withHttpClientHandler = new HttpClient(new HttpClientHandler -{ - CheckCertificateRevocationList = false -}); - -var withWinHttpHandler = new HttpClient(new WinHttpHandler -{ - CheckCertificateRevocationList = false -}); - -var withSocketsHttpHandler = new HttpClient(new SocketsHttpHandler -{ - SslOptions = - { - CertificateRevocationCheckMode = X509RevocationMode.NoCheck - } -}); -``` - -> [!NOTE] -> Due to a bug on the OSX platform, you might encounter certificate validation failures with in scenarios where the certificate doesn't support revocation checking via OCSP. This is a bug in the underlying platform crypto implementation. To avoid failing the certificate validation if revocation status can't be retrieved, either disable certificate revocation checking as per the previous instructions, or set to with set to `X509VerificationFlags.IgnoreEndRevocationUnknown | X509VerificationFlags.IgnoreCertificateAuthorityRevocationUnknown`. - -In situations where you can't modify the code, you can restore the previous behavior with one of the following settings: - -- Set `System.Net.Security.NoRevocationCheckByDefault` AppContext switch to `true`. -- Set `DOTNET_SYSTEM_NET_SECURITY_NOREVOCATIONCHECKBYDEFAULT` environment variable to `true`. - -## Affected APIs - -- -- -- -- -- (when using either or ) -- (when using either or ) diff --git a/docs/core/compatibility/toc.yml b/docs/core/compatibility/toc.yml index 2484881f84725..33939a4065721 100644 --- a/docs/core/compatibility/toc.yml +++ b/docs/core/compatibility/toc.yml @@ -106,8 +106,6 @@ items: items: - name: HTTP/3 support disabled by default with PublishTrimmed href: networking/10.0/http3-disabled-with-publishtrimmed.md - - name: HttpClient/SslStream default certificate revocation check mode changed to Online - href: networking/10.0/ssl-certificate-revocation-check-default.md - name: Streaming HTTP responses enabled by default in browser HTTP clients href: networking/10.0/default-http-streaming.md - name: "'Uri' length limits removed"