Use forTls parameter to enable TLS-compatible certificate key types while maintaining platform compatibility

src/libraries/Common/tests/System/Security/Cryptography/X509Certificates/CertificateAuthority.cs

@@ -106,7 +106,13 @@ internal sealed class CertificateAuthority : IDisposable
         // All keys created in this method are smaller than recommended,
         // but they only live for a few seconds (at most),
         // and never communicate out of process.
+        // Use different key sizes for crypto tests vs networking tests.
+        // Crypto tests prefer smaller keys for speed, networking tests need larger keys for compatibility.
+#if CRYPTO_TESTS
         const int DefaultKeySize = 1024;
+#else
+        const int DefaultKeySize = 2048;
+#endif
 
         internal CertificateAuthority(
             X509Certificate2 cert,

src/libraries/System.Net.Security/tests/FunctionalTests/NetworkingCertificateKeySizeTests.cs

@@ -0,0 +1,61 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using System.Security.Cryptography.X509Certificates.Tests.Common;
+using Xunit;
+
+namespace System.Net.Security.Tests
+{
+    public static class NetworkingCertificateKeySizeTests
+    {
+        [Fact]
+        public static void NetworkingTests_UseAppropriateCertificateKeySize()
+        {
+            // Test that networking tests use larger key sizes for compatibility
+            CertificateAuthority.BuildPrivatePki(
+                PkiOptions.EndEntityRevocationViaOcsp,
+                out RevocationResponder responder,
+                out CertificateAuthority rootAuthority,
+                out CertificateAuthority[] intermediateAuthorities,
+                out X509Certificate2 endEntityCert,
+                intermediateAuthorityCount: 1);
+
+            try
+            {
+                // Test the end entity certificate
+                using (RSA? eeRsa = endEntityCert.GetRSAPrivateKey())
+                {
+                    if (eeRsa != null)
+                    {
+                        // Networking tests should use larger key size for security/compatibility
+                        Assert.Equal(2048, eeRsa.KeySize);
+                    }
+                }
+
+                // Test the root authority certificate
+                using (X509Certificate2 rootCert = rootAuthority.CloneIssuerCert())
+                using (RSA? rootRsa = rootCert.GetRSAPrivateKey())
+                {
+                    if (rootRsa != null)
+                    {
+                        // Root certificate should also use larger key size
+                        Assert.Equal(2048, rootRsa.KeySize);
+                    }
+                }
+            }
+            finally
+            {
+                // Clean up
+                endEntityCert?.Dispose();
+                responder?.Dispose();
+                rootAuthority?.Dispose();
+                foreach (var auth in intermediateAuthorities)
+                {
+                    auth?.Dispose();
+                }
+            }
+        }
+    }
+}

src/libraries/System.Net.Security/tests/FunctionalTests/System.Net.Security.Tests.csproj

@@ -125,6 +125,7 @@
     <Compile Include="SslStreamCredentialCacheTest.cs" />
     <Compile Include="SslStreamSystemDefaultsTest.cs" />
     <Compile Include="SslStreamRemoteExecutorTests.cs" />
+    <Compile Include="NetworkingCertificateKeySizeTests.cs" />
   </ItemGroup>
   <ItemGroup Condition="'$(TargetPlatformIdentifier)' != 'browser'">
     <Compile Include="TelemetryTest.cs" />

src/libraries/System.Security.Cryptography/tests/CertificateAuthorityKeySizeTests.cs

@@ -0,0 +1,110 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using System.Security.Cryptography.X509Certificates.Tests.Common;
+using Xunit;
+
+namespace System.Security.Cryptography.Tests
+{
+    public static class CertificateAuthorityKeySizeTests
+    {
+        [Fact]
+        public static void CertificateAuthority_UsesAppropriateKeySize()
+        {
+            // Test that CertificateAuthority uses the expected key size based on preprocessor directive
+            CertificateAuthority.BuildPrivatePki(
+                PkiOptions.EndEntityRevocationViaOcsp,
+                out RevocationResponder responder,
+                out CertificateAuthority rootAuthority,
+                out CertificateAuthority[] intermediateAuthorities,
+                out X509Certificate2 endEntityCert,
+                intermediateAuthorityCount: 1);
+
+            try
+            {
+                // Test the root authority certificate
+                using (X509Certificate2 rootCert = rootAuthority.CloneIssuerCert())
+                using (RSA? rootRsa = rootCert.GetRSAPrivateKey())
+                {
+                    if (rootRsa != null)
+                    {
+#if CRYPTO_TESTS
+                        // In crypto tests, expect smaller key size for speed
+                        Assert.Equal(1024, rootRsa.KeySize);
+#else
+                        // In networking tests, expect larger key size for security
+                        Assert.Equal(2048, rootRsa.KeySize);
+#endif
+                    }
+                }
+
+                // Test the end entity certificate
+                using (RSA? eeRsa = endEntityCert.GetRSAPrivateKey())
+                {
+                    if (eeRsa != null)
+                    {
+#if CRYPTO_TESTS
+                        // In crypto tests, expect smaller key size for speed
+                        Assert.Equal(1024, eeRsa.KeySize);
+#else
+                        // In networking tests, expect larger key size for security
+                        Assert.Equal(2048, eeRsa.KeySize);
+#endif
+                    }
+                }
+            }
+            finally
+            {
+                // Clean up
+                endEntityCert?.Dispose();
+                responder?.Dispose();
+                rootAuthority?.Dispose();
+                foreach (var auth in intermediateAuthorities)
+                {
+                    auth?.Dispose();
+                }
+            }
+        }
+
+        [Fact]
+        public static void CertificateAuthority_WithRSAKeyFactory_UsesSpecifiedKeySize()
+        {
+            // Test that when an explicit RSA key factory is provided, it uses that size regardless of preprocessor directive
+            var customKeyFactory = CertificateAuthority.KeyFactory.RSASize(2048);
+
+            CertificateAuthority.BuildPrivatePki(
+                PkiOptions.EndEntityRevocationViaOcsp,
+                out RevocationResponder responder,
+                out CertificateAuthority rootAuthority,
+                out CertificateAuthority[] intermediateAuthorities,
+                out X509Certificate2 endEntityCert,
+                intermediateAuthorityCount: 1,
+                keyFactory: customKeyFactory);
+
+            try
+            {
+                // Regardless of preprocessor directive, explicit key factory should be used
+                using (RSA? eeRsa = endEntityCert.GetRSAPrivateKey())
+                {
+                    if (eeRsa != null)
+                    {
+                        Assert.Equal(2048, eeRsa.KeySize);
+                    }
+                }
+            }
+            finally
+            {
+                // Clean up
+                endEntityCert?.Dispose();
+                responder?.Dispose();
+                rootAuthority?.Dispose();
+                foreach (var auth in intermediateAuthorities)
+                {
+                    auth?.Dispose();
+                }
+            }
+        }
+    }
+}

src/libraries/System.Security.Cryptography/tests/System.Security.Cryptography.Tests.csproj

@@ -7,6 +7,7 @@
     <NoWarn>$(NoWarn);SYSLIB5006</NoWarn>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
     <StringResourcesPath>../src/Resources/Strings.resx</StringResourcesPath>
+    <DefineConstants>$(DefineConstants);CRYPTO_TESTS</DefineConstants>
   </PropertyGroup>
   <!-- DesignTimeBuild requires all the TargetFramework Derived Properties to not be present in the first property group. -->
   <PropertyGroup>
@@ -524,6 +525,7 @@
     <Compile Include="AsymmetricSignatureFormatterTests.cs" />
     <Compile Include="Base64TransformsTests.cs" />
     <Compile Include="BlockSizeValueTests.cs" />
+    <Compile Include="CertificateAuthorityKeySizeTests.cs" />
     <Compile Include="ChaCha20Poly1305Tests.cs" />
     <Compile Include="CngKeyTests.cs" />
     <Compile Include="CngUtility.cs" />