Skip to content

Commit 98666df

Browse files
authored
Update docs for SslCertificateTrust with changes in .NET 7
Changes implemented in dotnet/runtime#65195
1 parent 8f542f9 commit 98666df

File tree

1 file changed

+10
-2
lines changed

1 file changed

+10
-2
lines changed

xml/System.Net.Security/SslCertificateTrust.xml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,13 +55,18 @@
5555
5656
## Remarks
5757
58-
If the `sendTrustInHandshake` argument is `true`, the client can use the list of trusted certificate authorities from the server to select an appropriate client certificate. In .NET 6, the list is only sent on Windows, and it depends on a registry setting.
58+
If the `sendTrustInHandshake` argument is `true`, the client can use the list of trusted certificate authorities from the server to select an appropriate client certificate. Sending trusted issuers list is not supported for `SslCertificateTrust` instances created using the `SslCertificaetTrust.CreateForX509Collection` is not supported in .NET 6.
59+
60+
Since .NET 7, the sending trusted issuers list is supported on Linux and OSX platforms.
5961
6062
> [!WARNING]
6163
> The list of trusted CAs increases the size of the handshake message. It could also be viewed as an information leak about the system's configuration. For these reasons, we recommend setting `sendTrustInHandshake` to `false`.
6264
6365
]]></format>
6466
</remarks>
67+
<exception cref="T:System.PlatformNotSupportedException">
68+
<paramref name="sendTrustInHandshake"> is <see langword="true"> and the current platform does not support sending trusted issuers list in handshake.
69+
</exception>
6570
</Docs>
6671
</Member>
6772
<Member MemberName="CreateForX509Store">
@@ -94,13 +99,16 @@ If the `sendTrustInHandshake` argument is `true`, the client can use the list of
9499
95100
## Remarks
96101
97-
If the `sendTrustInHandshake` argument is `true`, the client can use the list of trusted certificate authorities from the server to select an appropriate client certificate. In .NET 6, the list is only sent on Windows, and it depends on a registry setting.
102+
If the `sendTrustInHandshake` argument is `true`, the client can use the list of trusted certificate authorities from the server to select an appropriate client certificate. In .NET 6, the list is only sent on Windows, and it depends on the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\SendTrustedIssuerList" registry setting being set to 1. Since .NET 7, the list is sent on Linux and OSX platforms as well.
98103
99104
> [!WARNING]
100105
> The list of trusted CAs increases the size of the handshake message. It could also be viewed as an information leak about the system's configuration. For these reasons, we recommend setting `sendTrustInHandshake` to `false`.
101106
102107
]]></format>
103108
</remarks>
109+
<exception cref="T:System.PlatformNotSupportedException">
110+
<paramref name="sendTrustInHandshake"> is <see langword="true"> and the current platform does not support sending trusted issuers list in handshake, or (on Windows) the <paramref name="store">'s location is not <xref:System.Security.Cryptography.X509Certificates.StoreLocation.LocalMachine>.
111+
</exception>
104112
</Docs>
105113
</Member>
106114
</Members>

0 commit comments

Comments
 (0)