aspnetcore/breaking-changes/6/clientcertificate-doesnt-trigger-renegotiation.md
The HttpContext.Connection.ClientCertificate property no longer triggers TLS renegotiations for HttpSys.
ASP.NET Core 6.0
Setting HttpSysOptions.ClientCertificateMethod = ClientCertificateMethod.AllowRenegotiation allowed renegotiation to be triggered by both HttpContext.Connection.ClientCertificate and HttpContext.Connection.GetClientCertificateAsync.
Setting HttpSysOptions.ClientCertificateMethod = ClientCertificateMethod.AllowRenegotiation allows renegotiation to be triggered only by HttpContext.Connection.GetClientCertificateAsync. HttpContext.Connection.ClientCertificate returns the current certificate if available, but does not renegotiate with the client to request the certificate.
When implementing the same features for Kestrel, it became clear that applications need to be able to check the state of the client certificate before triggering a renegotiation. For issues like the request body conflicting with the renegotiation, checking the state enables the following usage pattern to deal with the issue:
if (connection.ClientCertificate == null)
{
await BufferRequestBodyAsync();
await connection.GetClientCertificateAsync();
}
Apps that use delayed client-certificate negotiation should call xref:Microsoft.AspNetCore.Http.ConnectionInfo.GetClientCertificateAsync(System.Threading.CancellationToken) to trigger renegotiation.