[release/8.0-staging] macOS: Set certificate as a dependency of private key handles

[vcsjones]

Backport of #95924 and #96685 to release/8.0-staging

/cc @bartonjs

Customer Impact

Reported by multiple customers in #94959 and #95924 (comment). Customers that upgrade to .NET 8 from previous versions of .NET may receive an exception when attempting to use a private key from a certificate where the certificate has been disposed on macOS. The behavior contract of the key and certificate is that they have independent lifetimes and developers are not expected to keep the certificate alive for the duration of the private key.

Workarounds for the issue range from intrusive to not possible if the issue arises in a 3rd party library. This issue is impeding upgrades from .NET 6/7 to .NET 8.

Regression

Yes. #82205 made changes to reference lifetimes and commit 28f958d introduced the regression. We did not have unit tests asserting the independent lifetimes of the private key and the certificate.

Testing

New unit tests were introduced to prevent the fix from regressing; existing unit tests ensure existing scenarios continue to work.

Risk

Low and mitigated. This is a targeted change for macOS and the options for addressing the regression were discussed before making this fix.

[ghost]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Backport of #95924 and #96685 to release/8.0-staging

/cc @bartonjs

Customer Impact

Reported by multiple customers in #94959 and #95924 (comment). Customers that upgrade to .NET 8 from previous versions of .NET may receive an exception when attempting to use a private key from a certificate where the certificate has been disposed on macOS. The behavior contract of the key and certificate is that they have independent lifetimes and developers are not expected to key the certificate alive for the duration of the private key.

Workarounds for the issue range from intrusive to not possible if the issue arises in a 3rd party library.

Testing

New unit tests were introduced to prevent the fix from regressing; existing unit tests ensure existing scenarios continue to work.

Risk

Low.

Author:	vcsjones
Assignees:	-
Labels:	area-System.Security
Milestone:	8.0.x

[carlossanlop]

@bartonjs @jeffhandley today is Code Complete for the Feb Release. Are we going to try to get it merged today or should we wait another month?

[carlossanlop]

Approved by Tactics via email.