Do not include extensions sequence if no extensions

[vcsjones]

Fix for macOS Big Sur rejecting X509 certificates that have an empty extension sequence.

Fixes #40939

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq
See info in area-owners.md if you want to be subscribed.

[bartonjs]

Test failures look unrelated.

[danmoseley]

@bartonjs do we need a backport for this to 2.1 and/or 3.1?

[vcsjones]

@danmosemsft my 2c: it's a bit of a corner case. It will only occur when doing request.CertificateExtensions.Add(null);, and adding null isn't something someone would typically do. I would consider holding off on until a customer reports it. If one does, they have a work around: don't try to add null to the extensions list. null gets skipped anyway, so they wouldn't be losing anything.

[bartonjs]

I wouldn't. The test was largely codifying an API (mis)usage and maintaining some corner-case compat. As @vcsjones said while I was writing an equivalent statement: anyone who encounters this can do their own "don't add null to this collection".

The nullability annotations for the type say that null isn't supported in context, anyways (so we're really dealing with garbage-in, garbage-out; but we're now limiting how smelly the garbage is).

[danmoseley]

OK, thanks @bartonjs . What about #39603 is that likely to need backport? Since we have only today/tomorrowish if we want to do that and be in the patch before Big Sur ships.

[vcsjones]

Re: #39603, I can't reproduce it in netcoreapp3.1 or 2.1, only in 5 previews, so there isn't anything to fix in a backport that I've identified.

[danmoseley]

OK excellent thanks for the update!

[vcsjones]

Will the corefx repo get CI legs for Big Sur? If so, the test that prompted this change will start failing. We can either fix the test or port this if we need to.

[danmoseley]

I expect we will switch out a CI leg for Big Sur when it is released.

[vcsjones]

Should we preemptively try to address this then? It might make more sense to just change the test to wrap that part of the test in if (PlatformDetection.IsMacOSCatalinaOrLower) rather than changing product code. Not sure if that makes it easier for you on servicing paperwork.

[bartonjs]

I think on 2.1/3.1 we'd just guard the test.