[ci-scan] Test failure: System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCert [Content truncated due to length]

## Build Information
Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1582322
Build error leg or test failing: android-arm64 Release AllSubsets_CoreCLR - System.Security.Cryptography.Tests

KBE authoring guidance (ci-failure-scan)

- `Error Details` is for readers. Paste the full exception, stack trace, or build error excerpt so the failure is understandable without opening the raw log.
- Build Analysis parses only the single JSON block under `Error Message`.
- `ErrorMessage` is a case-sensitive ordinal `String.Contains` substring copied verbatim from the failing log.
- Set `BuildRetry` to `true` only for a clear infrastructure retry case. `ExcludeConsoleLog` disables Helix console-log scanning.

## Error Details

`System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate` fails on Android (android-arm64, android-arm) in `runtime-extra-platforms` for both `revocationMode: NoCheck` and `revocationMode: Online`. The chain build does not surface the expected `NotTimeValid` status for an expired self-signed certificate.

```
1) [FAIL] System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate Test name: ...BuildChainForExpiredSelfSignedCertificate(revocationMode: NoCheck)
Assembly: [System.Security.Cryptography.Tests, Version=11.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51]
Exception messages: NotTimeValid should be set; status flags: NoError
Exception stack traces: at System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate(X509RevocationMode revocationMode)

2) [FAIL] ...BuildChainForExpiredSelfSignedCertificate(revocationMode: Online)
Exception messages: NotTimeValid should be set; status flags: NoError
```

Observed in builds 1582322 (finished 2026-09-04) and 1584171 (finished 2026-09-05), on android-arm64 and android-arm legs.

## Error Message

```json
{
"ErrorMessage": [
"[FAIL] System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate",
"NotTimeValid should be set; status flags: NoError"
],
"ErrorPattern": "",
"BuildRetry": false,
"ExcludeConsoleLog": false
}
```

Agentic workflow metadata (ci-failure-scan)

Workflow artifact: ci-failure-scan
Artifact kind: kbe-verification
Verified match count: 2 hits in failure.log

---
Filed by [`ci-failure-scan`](https://github.com/dotnet/runtime/blob/main/.github/workflows/ci-failure-scan.md) (detection only). [`ci-failure-fix`](https://github.com/dotnet/runtime/blob/main/.github/workflows/ci-failure-fix.md) walks open `[ci-scan]` KBEs and either opens a small fix PR or comments here to loop in owners — it never disables the test.

> Generated by [CI Outer-Loop Failure Scanner](https://github.com/dotnet/runtime/actions/runs/34003248211) · opus48 · 990.8 AIC · ⌖ 13.1 AIC · ⊞ 20.7K · [◷](https://github.com/search?q=repo%3Adotnet%2Fruntime+is%3Aissue+%22gh-aw-workflow-call-id%3A+dotnet%2Fruntime%2Fci-failure-scan%22&type=issues)

### Report

|Build|Repository|Test|Pull Request|
|---|---|---|---|
|[1596986](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1596986)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1596986&view=ms.vss-test-web.build-test-results-tab&runId=44086228&resultId=199477)||
|[1594919](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1594919)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1594919&view=ms.vss-test-web.build-test-results-tab&runId=44033076&resultId=163401)||
|[1594486](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1594486)|dotnet/runtime|[System.Security.Cryptography.Tests.WorkItemExecution](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1594486&view=ms.vss-test-web.build-test-results-tab&runId=44015986&resultId=165862)||
|[1593920](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1593920)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1593920&view=ms.vss-test-web.build-test-results-tab&runId=43997114&resultId=167964)||
|[1592042](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1592042)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1592042&view=ms.vss-test-web.build-test-results-tab&runId=43948136&resultId=165989)||
|[1590326](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1590326)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1590326&view=ms.vss-test-web.build-test-results-tab&runId=43896844&resultId=162643)||
|[1588425](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1588425)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1588425&view=ms.vss-test-web.build-test-results-tab&runId=43842424&resultId=163918)||
|[1586642](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1586642)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1586642&view=ms.vss-test-web.build-test-results-tab&runId=43784768&resultId=167677)||
|[1585080](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1585080)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1585080&view=ms.vss-test-web.build-test-results-tab&runId=43738248&resultId=157636)||
|[1584749](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1584749)|dotnet/runtime|[System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1584749&view=ms.vss-test-web.build-test-results-tab&runId=43727220&resultId=162995)||
#### Summary
|24-Hour Hit Count|7-Day Hit Count|1-Month Count|
|---|---|---|
|1|7|10|

Start with System.Security.Cryptography.X509Certificates.Tests.DynamicChainTests.BuildChainForExpiredSelfSignedCertificate and the Android-arm64 and Android-arm failure logs. Compare the NoCheck and Online revocation-mode results with the expected NotTimeValid status. Done means the expired self-signed certificate reports NotTimeValid on the affected Android legs without disabling the test.

Written by the indexing model from the issue text.