Fix | Fix certificate validation

[arellegue]

This PR fixes issue #2178.

Problem was with Certificate Chain Link error, which is now resolved by comparing the binary raw data of the client certificate against the server certificate. If both certificates match, we allow it to continue. Prior to this, any certificate policy error, we stopped operations and threw an exception.

[JRahnama]

@David-Engel Even if two certificates have identical raw data, they will have different digital signatures if they are issued by different entities and also even if two certificates have identical raw data, they may have been issued to different subjects. The question would be is comparing two certificate raw data is enough to determine if they are equal?

I had an internal conversation and it is proven that I am wrong. Ignore my comment here.

[DavoudEshtehari]

Have you intentionally removed the Address, Circle, Shapes, and Utf8String projects?

[JRahnama]

Also, can you address pipeline failures?

[JRahnama]

There are couple of things here, generally it is better to use bash on ubuntu, you will have a better control over the commands.

1. Enabling as system CA certificate is missing here. It could be done by dpkg-reconfigure command
2. Remember since the server and client are on the same machine you need to configure them for both.
3. Removing '!' at the beginning of certificate inside ca-certificate is missed. You can test with sudo cat /etc/ca-certificates.conf command to ensure '!' is removed from the certificate name. If '!' shows up Infront of the certificate name it wont be included in update-ca-certificate command.
4. It is better to provide chmod 755/777 to ensure sql server has access to those files.

[JRahnama]

This could be simplified by adding DNSName to paramters.

[JRahnama]

Why on Unix you have chosen 4096 and on windows 2048 for key length?

[David-Engel]

Wouldn't this just mask if the test doesn't set up the server certificate correctly? (Same for line 117.)

[arellegue]

This was addressed in PR #2487.

[David-Engel]

This seems strange. Why do we switch between integrated and un/pw here? And why use the un/pw from the config? Doesn't the auth not matter since TestTdsServer doesn't care about auth here? Seems like this could be simplified to just a few lines... No?

Suggested change

	string userId = string.Empty;
	string password = string.Empty;
	SqlConnectionStringBuilder builder = new(DataTestUtility.TCPConnectionString);
	userId = builder.UserID;
	password = builder.Password;
	using TestTdsServer server = TestTdsServer.StartTestServer(enableFedAuth: false, enableLog: false, connectionTimeout: 15,
	methodName: "", new X509Certificate2(s_fullPathToPfx, "nopassword", X509KeyStorageFlags.UserKeySet),
	encryptionType: connectionTestParameters.TdsEncryptionType);
	if (userId != string.Empty)
	{
	builder = new(server.ConnectionString)
	{
	UserID = userId,
	Password = password,
	TrustServerCertificate = connectionTestParameters.TrustServerCertificate,
	Encrypt = connectionTestParameters.Encrypt,
	};
	}
	else
	{
	builder = new(server.ConnectionString)
	{
	IntegratedSecurity = true,
	TrustServerCertificate = connectionTestParameters.TrustServerCertificate,
	Encrypt = connectionTestParameters.Encrypt,
	};
	}
	if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows) && userId == string.Empty)
	{
	builder.IntegratedSecurity = false;
	builder.UserID = "user";
	builder.Password = "password";
	}
	using TestTdsServer server = TestTdsServer.StartTestServer(enableFedAuth: false, enableLog: false, connectionTimeout: 15,
	methodName: "", new X509Certificate2(s_fullPathToPfx, "nopassword", X509KeyStorageFlags.UserKeySet),
	encryptionType: connectionTestParameters.TdsEncryptionType);
	SqlConnectionStringBuilder builder = new(server.ConnectionString)
	{
	TrustServerCertificate = connectionTestParameters.TrustServerCertificate,
	Encrypt = connectionTestParameters.Encrypt,
	};

[arellegue]

This was addressed in PR #2487.

[DavoudEshtehari]

Closing as the rework has been merged with #2487.