[release/9.0-staging] Backport Replace test certificate chain that uses RSA+SHA-1

[vcsjones]

Backport of #121450 to release/9.0-staging

cc @bartonjs

Customer Impact

These are test only changes. These changes react to more environments in CI rejecting certificate chains that use an RSA+SHA-1 root certificate.

• Customer reported
• Found internally

Regression

• Yes
• No

Testing

Tests that were failing are now passing in CI.

Risk

None, test only changes.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

[Copilot]

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (1)

src/libraries/System.Security.Cryptography/tests/X509Certificates/ChainTests.cs:485

• [nitpick] The new assertion logic with Assert.Fail provides better diagnostics when chain validation doesn't match expectations. However, there's a potential inconsistency: the failure message uses single quotes around boolean values ('true', 'false') but uses single quotes around the chain flags string as well. Consider using consistent formatting, such as using backticks for code values or removing quotes from boolean values for consistency with typical C# boolean representations.

                chain.ChainPolicy.ExtraStore.Add(microsoftDotComRoot);

                // Ignore anything except NotTimeValid
                chain.ChainPolicy.VerificationFlags = X509VerificationFlags.AllFlags & ~X509VerificationFlags.IgnoreNotTimeValid;