Repository: dotnet/runtime
File: src/libraries/System.Net.Security/tests/FunctionalTests/SslStreamNetworkStreamTest.cs (C#)

Code before:
                SslServerAuthenticationOptions serverOptions = new SslServerAuthenticationOptions();
                serverOptions.ServerCertificateSelectionCallback =
                    (sender, name) =>
                    {
                        SslStream stream = (SslStream)sender;
                        Assert.Equal(targetName, stream.TargetHostName);

                        return certificate;
                    };

                await TestConfiguration.WhenAllOrAnyFailedWithTimeout(
                                client.AuthenticateAsClientAsync(clientOptions),
                                server.AuthenticateAsServerAsync(serverOptions));

                await TestHelper.PingPong(client, server);

                Assert.Equal(targetName, client.TargetHostName);
                Assert.Equal(targetName, server.TargetHostName);
                Assert.Equal(1, count);
            }
        }

        [Theory]
        [InlineData(true)]
        [InlineData(false)]
        public async Task SslStream_UntrustedCaWithCustomCallback_OK(bool usePartialCHain)
        {
            var clientOptions = new  SslClientAuthenticationOptions() { TargetHost = "localhost" };
            clientOptions.RemoteCertificateValidationCallback =
                (sender, certificate, chain, sslPolicyErrors) =>
                {
                    // Add only root CA to verify that peer did send intermediate CA cert.
                    chain.ChainPolicy.CustomTrustStore.Add(_serverChain[_serverChain.Count -1]);
                    chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;

                    bool result = chain.Build((X509Certificate2)certificate);
                    Assert.True(result);

                    return result;
                };

            var serverOptions = new SslServerAuthenticationOptions();

            X509Certificate2Collection serverChain;
            if (usePartialCHain)
            {
                // give certificates  without root
                serverChain = new X509Certificate2Collection();
                serverChain.Add(_serverChain[0]);
            }
            else

Review comment (security):
NIT: typo
```suggestion
        public async Task SslStream_UntrustedCaWithCustomCallback_OK(bool usePartialChain)
```

Code after:
                SslServerAuthenticationOptions serverOptions = new SslServerAuthenticationOptions();
                serverOptions.ServerCertificateSelectionCallback =
                    (sender, name) =>
                    {
                        SslStream stream = (SslStream)sender;
                        Assert.Equal(targetName, stream.TargetHostName);

                        return certificate;
                    };

                await TestConfiguration.WhenAllOrAnyFailedWithTimeout(
                                client.AuthenticateAsClientAsync(clientOptions),
                                server.AuthenticateAsServerAsync(serverOptions));

                await TestHelper.PingPong(client, server);

                Assert.Equal(targetName, client.TargetHostName);
                Assert.Equal(targetName, server.TargetHostName);
                Assert.Equal(1, count);
            }
        }

        [Theory]
        [InlineData(true)]
        [InlineData(false)]
        public async Task SslStream_UntrustedCaWithCustomCallback_OK(bool usePartialChain)
        {
            var rnd = new Random();
            int split = rnd.Next(0, _serverChain.Count - 1);

            var clientOptions = new  SslClientAuthenticationOptions() { TargetHost = "localhost" };
            clientOptions.RemoteCertificateValidationCallback =
                (sender, certificate, chain, sslPolicyErrors) =>
                {
                    // add our custom root CA
                    chain.ChainPolicy.CustomTrustStore.Add(_serverChain[_serverChain.Count - 1]);
                    chain.ChainPolicy.TrustMode = X509ChainTrustMode.CustomRootTrust;
                    // Add only one CA to verify that peer did send intermediate CA cert.
                    // In case of partial chain, we need to make missing certs available.
                    if (usePartialChain)
                    {
                        for (int i = split; i < _serverChain.Count - 1; i++)
                        {
                            chain.ChainPolicy.ExtraStore.Add(_serverChain[i]);
                        }
                    }

                    bool result = chain.Build((X509Certificate2)certificate);
                    Assert.True(result);

                    return result;