BuildChainForCertificateSignedWithDisallowedKey fails on macOS 26

[vcsjones]

This test is failing on macOS 26, beta 6.

Failed System.Security.Cryptography.X509Certificates.Tests.ChainTests.BuildChainForCertificateSignedWithDisallowedKey [4 ms]
  Error Message:
   Has expected flag ExplicitDistrust but was PartialChain
  Stack Trace:
     at System.Security.Cryptography.X509Certificates.Tests.ChainTests.BuildChainForCertificateSignedWithDisallowedKey() in /Users/vcsjones/Projects/runtime/src/libraries/System.Security.Cryptography/tests/X509Certificates/ChainTests.cs:line 1195
   at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
   at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
   at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args) in /Users/vcsjones/Projects/runtime/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs:line 36
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) in /Users/vcsjones/Projects/runtime/src/libraries/System.Private.CoreLib/src/System/Reflection/RuntimeMethodInfo.cs:line 126

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[vcsjones]

It looks like macOS 26 beta 6 removed their list of blocked certificates.

In macOS 15, plutil -p /System/Library/Security/Certificates.bundle/Contents/Resources/Blocked.plist has a number of blocked certificates (they are SHA-1 SKIs).

8868BFE08E35C43B386B62F7283B8481C80CD74D is one of the DigiNotar ones. Some of the others are DigiNotar, others are WoSign, etc.

In macOS 26, this Blocked.plist file is simply not present.

This seems reasonable as all of the certificates that are blocked would otherwise fail to build a chain because they are either expired, or were never trusted in the first place.

Since Apple has removed the Blocked plist entirely I don't know how we could "revive" the test on macOS 26. There are no certificates that are blocked by SKIs anymore. They are distrusted by other means (and we can't add one ourselves)

[vcsjones]

Fixed by #118652.