Add logging if we detect the app host is running with an untrusted dev cert by danegsta · Pull Request #14666 · microsoft/aspire

danegsta · 2026-02-25T00:45:58Z

Description

It's possible, particularly after .NET SDK updates, to end up in a situation where there's a newer dev cert added to the CurrentUser/My cert store (which is the source of dev certs for TLS termination), but not to the CurrentUser/Root cert store which is where trusted certificates are pulled from. This can lead to a situation where services try to terminate HTTPS endpoints with an updated dev cert, but nothing actually trusts the new certificate. Diagnosing the issue is confusing and can require checking the logs for individual services.

This adds an explicit error level log if automatic dev cert trust is enabled and the latest certificate isn't in the trusted root store.

This replaces #13943 in targeting release/13.2.

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No
Does the change require an update in our Aspire docs?
- Yes
  - Link to aspire-docs issue (consider using one of the following templates):
- No

…v cert

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…il APIs with async/await (#14110)

github-actions · 2026-02-25T00:46:06Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14666

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14666"

Copilot

Pull request overview

This PR improves diagnosability when Aspire is configured to automatically trust the ASP.NET Core development certificate but the newest dev cert is not actually trusted by the OS trust store, by surfacing an app-host log and a dashboard notification.

Changes:

Add a dev-certificate trust check during DcpHost startup and emit a dashboard notification when the latest dev cert isn’t trusted.
Add cross-platform trust detection helper in DeveloperCertificateService (Root store check on Windows/Linux; security verify-cert on macOS).
Ensure the dashboard resource can be configured with a Kestrel certificate callback when HTTPS endpoints are present, plus add new localized strings and update tests.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/Aspire.Hosting.Tests/Dcp/DcpHostNotificationTests.cs	Updates `DcpHost` construction in tests to pass new dependencies.
tests/Aspire.Hosting.Tests/Dashboard/DashboardResourceTests.cs	Adds a test validating the dashboard resource is annotated with an HTTPS/Kestrel certificate callback when using HTTPS.
src/Aspire.Hosting/DeveloperCertificateService.cs	Adds certificate trust probing helper and disposes unused cert instances.
src/Aspire.Hosting/Dcp/DcpHost.cs	Runs dev-cert trust check at startup and prompts a dashboard notification when trust is missing.
src/Aspire.Hosting/Dashboard/DashboardEventHandlers.cs	Adds logic to attach a Kestrel certificate configuration callback when dashboard endpoints include HTTPS.
src/Aspire.Hosting/AspireEventSource.cs	Adds EventSource events for dev-cert trust check start/stop.
src/Aspire.Hosting/Resources/InteractionStrings.resx	Adds new strings for “development certificate not fully trusted” title/message.
src/Aspire.Hosting/Resources/InteractionStrings.Designer.cs	Regenerates strongly-typed resource accessors for the new strings.
src/Aspire.Hosting/Resources/xlf/InteractionStrings.cs.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.de.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.es.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.fr.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.it.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.ja.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.ko.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.pl.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.pt-BR.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.ru.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.tr.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.zh-Hans.xlf	Adds new string IDs for translation (state=new).
src/Aspire.Hosting/Resources/xlf/InteractionStrings.zh-Hant.xlf	Adds new string IDs for translation (state=new).

Files not reviewed (1)

src/Aspire.Hosting/Resources/InteractionStrings.Designer.cs: Language not supported

src/Aspire.Hosting/DeveloperCertificateService.cs

src/Aspire.Hosting/Dcp/DcpHost.cs

src/Aspire.Hosting/Dashboard/DashboardEventHandlers.cs

github-actions · 2026-02-25T01:43:51Z

🎬 CLI E2E Test Recordings

The following terminal recordings are available for commit 1f08c4e:

Test	Recording
AddPackageInteractiveWhileAppHostRunningDetached	▶️ View Recording
AddPackageWhileAppHostRunningDetached	▶️ View Recording
AgentCommands_AllHelpOutputs_AreCorrect	▶️ View Recording
AgentInitCommand_DefaultSelection_InstallsSkillOnly	▶️ View Recording
AgentInitCommand_MigratesDeprecatedConfig	▶️ View Recording
AspireUpdateRemovesAppHostPackageVersionFromDirectoryPackagesProps	▶️ View Recording
Banner_DisplayedOnFirstRun	▶️ View Recording
Banner_DisplayedWithExplicitFlag	▶️ View Recording
CreateAndDeployToDockerCompose	▶️ View Recording
CreateAndDeployToDockerComposeInteractive	▶️ View Recording
CreateAndPublishToKubernetes	▶️ View Recording
CreateAndRunAspireStarterProject	▶️ View Recording
CreateAndRunAspireStarterProjectWithBundle	▶️ View Recording
CreateAndRunJsReactProject	▶️ View Recording
CreateAndRunPythonReactProject	▶️ View Recording
CreateAndRunTypeScriptStarterProject	▶️ View Recording
CreateEmptyAppHostProject	▶️ View Recording
CreateStartAndStopAspireProject	▶️ View Recording
CreateStartWaitAndStopAspireProject	▶️ View Recording
CreateTypeScriptAppHostWithViteApp	▶️ View Recording
DescribeCommandResolvesReplicaNames	▶️ View Recording
DescribeCommandShowsRunningResources	▶️ View Recording
DetachFormatJsonProducesValidJson	▶️ View Recording
DoctorCommand_DetectsDeprecatedAgentConfig	▶️ View Recording
DoctorCommand_WithSslCertDir_ShowsTrusted	▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	▶️ View Recording
LogsCommandShowsResourceLogs	▶️ View Recording
PsCommandListsRunningAppHost	▶️ View Recording
PsFormatJsonOutputsOnlyJsonToStdout	▶️ View Recording
RestoreGeneratesSdkFiles	▶️ View Recording
SecretCrudOnDotNetAppHost	▶️ View Recording
SecretCrudOnTypeScriptAppHost	▶️ View Recording
StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels	▶️ View Recording
StopAllAppHostsFromAppHostDirectory	▶️ View Recording
StopAllAppHostsFromUnrelatedDirectory	▶️ View Recording
StopNonInteractiveMultipleAppHostsShowsError	▶️ View Recording
StopNonInteractiveSingleAppHost	▶️ View Recording
StopWithNoRunningAppHostExitsSuccessfully	▶️ View Recording
TypeScriptAppHostWithProjectReferenceIntegration	▶️ View Recording

_{📹 Recordings uploaded automatically from CI run #22814938132}

danegsta · 2026-02-25T01:50:00Z

@karolz-ms @joperezr heads up but we'll have to decide how we want to deal with a merge conflict in AspireEventSource.cs between this PR and #14557

src/Aspire.Hosting/Dashboard/DashboardEventHandlers.cs

src/Aspire.Hosting/Dcp/DcpHost.cs

JamesNK · 2026-02-25T04:54:38Z

src/Aspire.Hosting/Dcp/DcpHost.cs

    public async Task StartAsync(CancellationToken cancellationToken)
    {
        await EnsureDcpContainerRuntimeAsync(cancellationToken).ConfigureAwait(false);
+        await EnsureDevelopmentCertificateTrustAsync(cancellationToken).ConfigureAwait(false);


Why in the DCP host? Doesn't seem DCP related to me.

What about doing it in an app host event? For example, Seb added detection for whether secrets are disable and you have persistent container in an app host event.

This was purely because it's the place we're doing existing startup runtime dependency checks (the container health check also lives here). We may be able to decide on a better location, but for now this is a location of convenience.

JamesNK · 2026-02-25T04:56:59Z

src/Aspire.Hosting/DeveloperCertificateService.cs

    /// <inheritdoc />
    public bool UseForHttps { get; }
+
+    internal static async Task<bool> IsCertificateTrustedAsync(IFileSystemService fileSystemService, X509Certificate2 certificate, CancellationToken cancellationToken = default)


Someone else will have to review this. I'm not an expert in this area.

This was reviewed in the previous version of the PR that stalled out due to a test issue that's now fixed. I re-opened because the old one was targeting main instead of release/13.2.

src/Aspire.Hosting/Dcp/DcpHost.cs

…ates

src/Aspire.Hosting/Dcp/DcpHost.cs

Co-authored-by: Damian Edwards <damian@damianedwards.com>

danegsta · 2026-03-07T20:46:24Z

@copilot update other strings in the PR that reference running dotnet dev-certs commands to use the See https://aka.ms/aspire/devcerts for more information. reference instead.

Copilot · 2026-03-07T20:46:33Z

@danegsta I've opened a new pull request, #15042, to work on those changes. Once the pull request is ready, I'll request review from you.

…v cert (#15042) * Initial plan * Replace dotnet dev-certs command references with aka.ms/aspire/devcerts link Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com>

danegsta · 2026-03-07T21:17:38Z

@copilot there's a failing test that's looking for outdated strings after the latest changes.

Copilot · 2026-03-07T21:17:45Z

@danegsta I've opened a new pull request, #15043, to work on those changes. Once the pull request is ready, I'll request review from you.

…/devcerts (#15043) * Initial plan * Fix failing test that was checking for outdated string content after log message update Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com>

src/Aspire.Hosting/Resources/InteractionStrings.resx

Copilot · 2026-03-08T04:31:19Z

@danegsta I've opened a new pull request, #15048, to work on those changes. Once the pull request is ready, I'll request review from you.

…ificate" in user-facing strings (#15048) * Initial plan * Replace "ASP.NET Core Development Certificate" with "development certificate" in strings Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com>

…v cert (#14666) * Add logging if we detect the app host is running with an untrusted dev cert * Allow overriding the dev cert used by the dashboard * Also notify the dashboard if the certificate isn't trusted * Update src/Aspire.Hosting/DeveloperCertificateService.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Move forward unlocking the macos keychain and trust the cert * Update trust check to handle MacOS * Add link to dev-certs code * Cleanup some of the exceptions * Trusting on Mac isn't going to be an option; switch to a warning in logs * Use resource strings, move check and logging to DcpHost setup * Update how HTTPS check is determined * Use the file system service to get a temp folder * Refactor DeveloperCertificateService to use ProcessSpec and ProcessUtil APIs with async/await (#14110) * Update test service mocks * Guard against the interaction service not being available * Fix merge issue in DashboardEventHandlers * Fix developer cert service timeout on Mac CI * Only skip interaction service prompt if service not available * Add additional test * Fix failing test * Disable dev cert https in mac ci tests * Revert unrequired macos timeout change * Add comments explaining the dashboard certificate config * Only warn if there's an HTTPS/TLS endpoint * Cleanup how we determine certificate trust to a cross-platform approach * Expose interface property such that it can be used in tests * Add chain build that got removed * Check if cert is in root store on Windows * Fix check that wasn't properly detecting the lack of trusted certificates * Update src/Aspire.Hosting/Dcp/DcpHost.cs Co-authored-by: Damian Edwards <damian@damianedwards.com> * Add logging if we detect the app host is running with an untrusted dev cert (#15042) * Initial plan * Replace dotnet dev-certs command references with aka.ms/aspire/devcerts link Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> * Fix failing test after log message updated to reference aka.ms/aspire/devcerts (#15043) * Initial plan * Fix failing test that was checking for outdated string content after log message update Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> * Replace "ASP.NET Core Development Certificate" with "development certificate" in user-facing strings (#15048) * Initial plan * Replace "ASP.NET Core Development Certificate" with "development certificate" in strings Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: danegsta <50252651+danegsta@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Damian Edwards <damian@damianedwards.com>

danegsta and others added 15 commits February 24, 2026 16:30

Add logging if we detect the app host is running with an untrusted de…

3c42e64

…v cert

Allow overriding the dev cert used by the dashboard

77d3818

Also notify the dashboard if the certificate isn't trusted

be562bd

Update src/Aspire.Hosting/DeveloperCertificateService.cs

33f0d1e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Move forward unlocking the macos keychain and trust the cert

7d95f07

Update trust check to handle MacOS

b79f3cd

Add link to dev-certs code

60fe2d2

Cleanup some of the exceptions

9bf3372

Trusting on Mac isn't going to be an option; switch to a warning in logs

1fb6076

Use resource strings, move check and logging to DcpHost setup

1783692

Update how HTTPS check is determined

0eb5f0c

Use the file system service to get a temp folder

85e6e21

Refactor DeveloperCertificateService to use ProcessSpec and ProcessUt…

30f474b

…il APIs with async/await (#14110)

Update test service mocks

1009421

Guard against the interaction service not being available

ca2f7e9

danegsta requested a review from mitchdenny as a code owner February 25, 2026 00:45

Copilot AI review requested due to automatic review settings February 25, 2026 00:45

Copilot started reviewing on behalf of danegsta February 25, 2026 00:46 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

danegsta added 3 commits February 24, 2026 16:59

Fix merge issue in DashboardEventHandlers

d2c166a

Fix developer cert service timeout on Mac CI

797e82e

Only skip interaction service prompt if service not available

4021dbc

danegsta mentioned this pull request Feb 25, 2026

Add logging if we detect the app host is running with an untrusted dev cert #13943

Closed

16 tasks

Add additional test

b972a48

Fix failing test

2f1f17c

github-actions bot mentioned this pull request Feb 25, 2026

[pull requests] Review required #13834

Open

JamesNK reviewed Feb 25, 2026

View reviewed changes

danegsta added 5 commits March 4, 2026 13:12

Cleanup how we determine certificate trust to a cross-platform approach

98d854b

Expose interface property such that it can be used in tests

e145d44

Add chain build that got removed

41e6906

Check if cert is in root store on Windows

8988e3f

Fix check that wasn't properly detecting the lack of trusted certific…

0415f8a

…ates

This was referenced Mar 5, 2026

[13.2-burndown] Daily Burndown Report - March 5, 2026 #14972

Closed

[13.2-burndown] Daily Burndown Report - March 7, 2026 #15039

Closed

davidfowl reviewed Mar 7, 2026

View reviewed changes

src/Aspire.Hosting/Dcp/DcpHost.cs Outdated Show resolved Hide resolved

Update src/Aspire.Hosting/Dcp/DcpHost.cs

6a951b3

Co-authored-by: Damian Edwards <damian@damianedwards.com>

danegsta mentioned this pull request Mar 7, 2026

[13.2] Add a new aka.ms link and documentation on setup of developer certificates microsoft/aspire.dev#526

Open

Copilot AI mentioned this pull request Mar 7, 2026

Add logging if we detect the app host is running with an untrusted dev cert #15042

Merged

16 tasks

Copilot AI mentioned this pull request Mar 7, 2026

Fix failing test after log message updated to reference aka.ms/aspire/devcerts #15043

Merged

16 tasks

davidfowl reviewed Mar 8, 2026

View reviewed changes

src/Aspire.Hosting/Resources/InteractionStrings.resx Show resolved Hide resolved

Copilot AI mentioned this pull request Mar 8, 2026

Replace "ASP.NET Core Development Certificate" with "development certificate" in user-facing strings #15048

Merged

16 tasks

github-actions bot mentioned this pull request Mar 8, 2026

[13.2-burndown] Daily Burndown Report - March 8, 2026 #15052

Closed

karolz-ms approved these changes Mar 9, 2026

View reviewed changes

danegsta merged commit 542c3f5 into release/13.2 Mar 9, 2026
1112 of 1123 checks passed

danegsta deleted the danegsta/trustLog branch March 9, 2026 22:28

dotnet-policy-service bot added this to the 13.2 milestone Mar 9, 2026

danegsta mentioned this pull request Mar 10, 2026

Aspire should prefer older trusted dev cert over newer untrusted ones. #14296

Closed

1 task

radical mentioned this pull request Mar 11, 2026

Merge release/13.2 into main #15151

Merged

16 tasks

Conversation

danegsta commented Feb 25, 2026

Description

Checklist

Uh oh!

github-actions bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎬 CLI E2E Test Recordings

Uh oh!

danegsta commented Feb 25, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JamesNK Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

danegsta Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

JamesNK Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

danegsta Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

danegsta commented Mar 7, 2026

Uh oh!

Copilot AI commented Mar 7, 2026

Uh oh!

danegsta commented Mar 7, 2026

Uh oh!

Copilot AI commented Mar 7, 2026

Uh oh!

Uh oh!

Copilot AI commented Mar 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

github-actions bot commented Feb 25, 2026 •

edited

Loading

github-actions bot commented Feb 25, 2026 •

edited

Loading