Dispose X509Certificate2 when the connector is cleaned up (npgsql#4975)

Fixes npgsql#4969

Author: roji

src/Npgsql/Internal/NpgsqlConnector.cs

@@ -283,6 +283,8 @@ internal bool PostgresCancellationPerformed
     internal bool AttemptPostgresCancellation { get; private set; }
     static readonly TimeSpan _cancelImmediatelyTimeout = TimeSpan.FromMilliseconds(-1);
 
+    X509Certificate2? _certificate;
+
     internal NpgsqlLoggingConfiguration LoggingConfiguration { get; }
 
     internal ILogger ConnectionLogger { get; }
@@ -756,7 +758,6 @@ async ValueTask<string> GetUsernameAsyncInternal()
 
     async Task RawOpen(SslMode sslMode, NpgsqlTimeout timeout, bool async, CancellationToken cancellationToken, bool isFirstAttempt = true)
     {
-        var cert = default(X509Certificate2?);
         try
         {
             if (async)
@@ -815,15 +816,15 @@ async Task RawOpen(SslMode sslMode, NpgsqlTimeout timeout, bool async, Cancellat
 #if NET5_0_OR_GREATER
                             // It's PEM time
                             var keyPath = Settings.SslKey ?? PostgresEnvironment.SslKey ?? PostgresEnvironment.SslKeyDefault;
-                            cert = string.IsNullOrEmpty(password)
+                            _certificate = string.IsNullOrEmpty(password)
                                 ? X509Certificate2.CreateFromPemFile(certPath, keyPath)
                                 : X509Certificate2.CreateFromEncryptedPemFile(certPath, password, keyPath);
                             if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
                             {
                                 // Windows crypto API has a bug with pem certs
                                 // See #3650
-                                using var previousCert = cert;
-                                cert = new X509Certificate2(cert.Export(X509ContentType.Pkcs12));
+                                using var previousCert = _certificate;
+                                _certificate = new X509Certificate2(_certificate.Export(X509ContentType.Pkcs12));
                             }
 #else
                             // Technically PEM certificates are supported as of .NET 5 but we don't build for the net5.0
@@ -833,8 +834,8 @@ async Task RawOpen(SslMode sslMode, NpgsqlTimeout timeout, bool async, Cancellat
 #endif
                         }
 
-                        cert ??= new X509Certificate2(certPath, password);
-                        clientCertificates.Add(cert);
+                        _certificate ??= new X509Certificate2(certPath, password);
+                        clientCertificates.Add(_certificate);
                     }
 
                     ClientCertificatesCallback?.Invoke(clientCertificates);
@@ -851,10 +852,10 @@ async Task RawOpen(SslMode sslMode, NpgsqlTimeout timeout, bool async, Cancellat
                             throw new ArgumentException(string.Format(NpgsqlStrings.CannotUseSslVerifyWithUserCallback, sslMode));
 
                         if (Settings.RootCertificate is not null)
-                            throw new ArgumentException(string.Format(NpgsqlStrings.CannotUseSslRootCertificateWithUserCallback));
+                            throw new ArgumentException(NpgsqlStrings.CannotUseSslRootCertificateWithUserCallback);
 
                         if (DataSource.RootCertificateCallback is not null)
-                            throw new ArgumentException(string.Format(NpgsqlStrings.CannotUseValidationRootCertificateCallbackWithUserCallback));
+                            throw new ArgumentException(NpgsqlStrings.CannotUseValidationRootCertificateCallbackWithUserCallback);
 
                         certificateValidationCallback = UserCertificateValidationCallback;
                     }
@@ -921,7 +922,8 @@ async Task RawOpen(SslMode sslMode, NpgsqlTimeout timeout, bool async, Cancellat
         }
         catch
         {
-            cert?.Dispose();
+            _certificate?.Dispose();
+            _certificate = null;
 
             _stream?.Dispose();
             _stream = null!;
@@ -2179,6 +2181,12 @@ void Cleanup()
         Connection = null;
         PostgresParameters.Clear();
         _currentCommand = null;
+
+        if (_certificate is not null)
+        {
+            _certificate.Dispose();
+            _certificate = null;
+        }
     }
 
     void GenerateResetMessage()