Summary of the Pull Request

Fix intermittent certificate-generation failures in the existing Settings unit test CustomRootTrustChainAcceptsIntermediateFromExtraStore.

Intermediate and leaf test certificates now inherit their issuer's UTC validity interval instead of independently calculating an expiry from the current time. This prevents a child certificate from expiring after its issuer when generation crosses a second boundary.

This is an independent, single-file test fix. It does not include the Workspaces feature or diagnostic test exclusions from #50508 / #50576.

PR Checklist

• [x] Communication: The test-fixture fix was discussed and requested during the CI investigation.


• [x] Tests: Added a deterministic regression; both affected certificate-chain tests pass locally.

N/A: end-user localization, developer/user documentation, new binaries, installer changes, and product settings migrations.

Detailed Description of the Pull Request / Additional comments

Only src/settings-ui/Settings.UI.UnitTests/MouseWithoutBordersIpcSecurityTests.cs changes:

• Reuse issuer.NotBefore and issuer.NotAfter, converted to UTC, when generating intermediate and leaf certificates.


• Preserve the root fixture's default seven-day expiry and all existing certificate-chain assertions.


• Add GeneratedCertificateChainUsesIssuerValidity, using a one-day issuer to deterministically expose the old seven-day child expiry without sleeps or dependence on clock timing.

The original failure occurred in test setup, before the intended chain-validation assertions. Examples:

• 
  Build 388854: leaf expiry was one second later than its issuer; CertificateRequest.Create threw ArgumentException.


• 
  Build 388859: the same issue occurred while creating the intermediate certificate.

Production signing/trust policy, IPC, and Windows trust stores are unchanged. No tests or assertions are disabled by this PR.

Validation Steps Performed

• Built the real Settings.UI.UnitTests project in x64 Release with the repository build scripts.


• Confirmed the new short-lived-issuer regression fails on the old helpers with the expected notAfter exception.


• After the fix, ran the original chain test and the new regression: 2 passed, 0 failed, 0 skipped.


• The exact tested file was cherry-picked from the diagnostic worktree onto a clean main-based branch; verified byte-identical source and a single-file diff.


• Full CI 388863: succeeded, including x64 and ARM64 builds.


• Native Tests completed successfully: 7,972 passed, 18 existing skipped cases, 0 failures; vstest.console.exe exited with code 0. The original certificate-chain test and the new regression both explicitly passed in CI.