Log a warning when using an untrusted developer certificate

[Tratcher]

Fixes #41990

If the developer certificate is present but untrusted, today Kestrel will load it without comment:

dbug: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[0]
      Using development certificate: CN=localhost (Thumbprint: 35775CD3DF9AD7ED5835C7AC665095CA89B001B1)

I've added a check to ensure the certificate is trusted. Now it shows:

warn: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[5]
      The ASP.NET Core developer certificate is not trusted.
fail: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[4]
      The ASP.NET Core developer certificate is in an invalid state. To fix this issue, run the following commands 'dotnet dev-certs https --clean' and 'dotnet dev-certs https' to remove all existing ASP.NET Core development certificates and create a new untrusted developer certificate. On macOS or Windows, use 'dotnet dev-certs https --trust' to trust the new certificate.
dbug: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[0]
      Using development certificate: CN=localhost (Thumbprint: 35775CD3DF9AD7ED5835C7AC665095CA89B001B1)

The second log is the same message used on mac clients when the cert isn't valid.

We do not attempt to trigger the interactive trust prompt from Kestrel.

[adityamandaleeka]

LGTM provided that you've confirmed it doesn't prompt when doing the trust check (I don't think it does on Windows given how IsTrusted is implemented, but just want us to be sure).

[javiercn]

Why are we checking this here?

CheckCertificateState was here to detect when we needed to take action to fix the certificate on Mac OS (which we might need to take again)

[javiercn]

Is there a reason why we can't do CheckCertificateState first on kestrel and then if that succeeds call IsTrusted(certificate)?

[JamesNK]

I like it.

For extra points, what about adding an aka.ms link to https://docs.microsoft.com/aspnet/core/security/enforcing-ssl#trust-the-aspnet-core-https-development-certificate-on-windows-and-macos to the log message. e.g.

... For more information, see https://aka.ms/aspnet/https-trust-dev-cert

[Tratcher]

New warning (plus an aka.ms link that's in progress):

dbug: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[0]
      Using development certificate: CN=localhost (Thumbprint: E3920EABCAAC6D2B5535B40D406C5FFE74E8D06E)
warn: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[8]
      The ASP.NET Core developer certificate is not trusted.