Wrap exceptions from ManagedHandler's server validation callback

src/System.Net.Http/src/System/Net/Http/Managed/HttpConnectionHandler.cs

@@ -50,7 +50,14 @@ private async ValueTask<SslStream> EstablishSslConnection(string host, HttpReque
             {
                 callback = (object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors) =>
                 {
-                    return _settings._serverCertificateCustomValidationCallback(request, certificate as X509Certificate2, chain, sslPolicyErrors);
+                    try
+                    {
+                        return _settings._serverCertificateCustomValidationCallback(request, certificate as X509Certificate2, chain, sslPolicyErrors);
+                    }
+                    catch (Exception e)
+                    {
+                        throw new HttpRequestException(SR.net_http_ssl_connection_failed, e);
+                    }
                 };
             }
 

src/System.Net.Http/tests/FunctionalTests/HttpClientHandlerTest.ServerCertificates.cs

@@ -208,11 +208,6 @@ public async Task UseCallback_CallbackReturnsFailure_ThrowsException()
         [ConditionalFact(nameof(BackendSupportsCustomCertificateHandling))]
         public async Task UseCallback_CallbackThrowsException_ExceptionPropagatesAsBaseException()
         {
-            if (ManagedHandlerTestHelpers.IsEnabled)
-            {
-                return; // TODO #21904: ManagedHandler is not properly wrapping exception.
-            }
-
             if (BackendDoesNotSupportCustomCertificateHandling) // can't use [Conditional*] right now as it's evaluated at the wrong time for the managed handler
             {
                 Console.WriteLine($"Skipping {nameof(UseCallback_CallbackThrowsException_ExceptionPropagatesAsBaseException)}()");