TlsSession.SetRemoteCertificateValidationResult rejection message ends in a literal {0} #135349

                if (_isHandshakeComplete)
                {
                    _externalValidationFault = new AuthenticationException(SR.net_ssl_io_cert_validation);

                    _externalValidationFault = new AuthenticationException(SR.net_ssl_io_cert_validation);

                return ExceptionDispatchInfo.SetCurrentStackTrace(new AuthenticationException(SR.Format(SR.net_ssl_io_cert_validation, sslPolicyErrors), null));

using System.Net;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;

foreach (SslProtocols protocol in new[] { SslProtocols.Tls12, SslProtocols.Tls13 })
{
    Console.WriteLine($"{protocol}: {await RejectClientCertificateAsync(protocol)}");
}

static async Task<string> RejectClientCertificateAsync(SslProtocols protocol)
{
    using X509Certificate2 serverCert = CreateCertificate("CN=localhost");
    using X509Certificate2 clientCert = CreateCertificate("CN=client");

    using var listener = new TcpListener(IPAddress.Loopback, 0);
    listener.Start();
    using var clientTcp = new TcpClient();
    await clientTcp.ConnectAsync(IPAddress.Loopback, ((IPEndPoint)listener.LocalEndpoint).Port);
    using TcpClient serverTcp = await listener.AcceptTcpClientAsync();
    NetworkStream transport = serverTcp.GetStream();

    using var clientSsl = new SslStream(clientTcp.GetStream(), false, (_, _, _, _) => true);
    _ = clientSsl.AuthenticateAsClientAsync(new SslClientAuthenticationOptions
    {
        TargetHost = "localhost",
        EnabledSslProtocols = protocol,
        ClientCertificates = new X509CertificateCollection { clientCert },
    });

    // No RemoteCertificateValidationCallback: the caller validates the client certificate.
    using TlsContext context = TlsContext.CreateServer(new SslServerAuthenticationOptions
    {
        ServerCertificate = serverCert,
        EnabledSslProtocols = protocol,
        ClientCertificateRequired = true,
    });
    using var session = new TlsBufferSession();
    session.SetContext(context);

    byte[] input = new byte[32 * 1024];
    byte[] output = new byte[32 * 1024];
    int inputLength = 0;
    try
    {
        while (!session.IsHandshakeComplete)
        {
            TlsOperationStatus status = session.Handshake(input.AsSpan(0, inputLength), output, out int consumed, out int written);
            input.AsSpan(consumed, inputLength - consumed).CopyTo(input);
            inputLength -= consumed;
            await transport.WriteAsync(output.AsMemory(0, written));
            while (session.HasPendingOutput)
            {
                session.DrainPendingOutput(output, out written);
                await transport.WriteAsync(output.AsMemory(0, written));
            }

            if (status == TlsOperationStatus.NeedsCertificateValidation)
            {
                session.SetRemoteCertificateValidationResult(SslPolicyErrors.RemoteCertificateChainErrors);
            }
            else if (status == TlsOperationStatus.NeedMoreData)
            {
                int read = await transport.ReadAsync(input.AsMemory(inputLength));
                if (read == 0)
                {
                    return "peer closed the connection";
                }
                inputLength += read;
            }
        }

        session.Write("hello"u8, output, out _, out _);
        return "no exception";
    }
    catch (AuthenticationException ex)
    {
        return $"{ex.GetType().Name}: {ex.Message}";
    }
}

static X509Certificate2 CreateCertificate(string subject)
{
    using RSA key = RSA.Create(2048);
    var request = new CertificateRequest(subject, key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
    using X509Certificate2 certificate = request.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(1));
    return X509CertificateLoader.LoadPkcs12(certificate.Export(X509ContentType.Pfx), null);
}