Add logging if we detect the app host is running with an untrusted dev cert by danegsta · Pull Request #13943 · microsoft/aspire

David Negstad (danegsta) · 2026-01-15T21:44:29Z

Description

It's possible, particularly after .NET SDK updates, to end up in a situation where there's a newer dev cert added to the CurrentUser/My cert store (which is the source of dev certs for TLS termination), but not to the CurrentUser/Root cert store which is where trusted certificates are pulled from. This can lead to a situation where services try to terminate HTTPS endpoints with an updated dev cert, but nothing actually trusts the new certificate. Diagnosing the issue is confusing and can require checking the logs for individual services.

This adds an explicit error level log if automatic dev cert trust is enabled and the latest certificate isn't in the trusted root store.

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No
Does the change require an update in our Aspire docs?
- Yes
  - Link to aspire-docs issue (consider using one of the following templates):
- No

…v cert

github-actions · 2026-01-15T21:44:37Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 13943

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 13943"

Copilot

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot · 2026-01-15T22:26:16Z

David Negstad (@danegsta) I've opened a new pull request, #13946, to work on those changes. Once the pull request is ready, I'll request review from you.

David Fowler (davidfowl) · 2026-01-15T23:29:45Z

Logging isn't good enough, lets turn this into a notification.

…ta/trust

David Negstad (danegsta) · 2026-01-16T00:31:10Z

Logging isn't good enough, lets turn this into a notification.

Added both a notification and explicitly controlling the dev cert the dashboard uses.

…ta/trust

Mitch Denny (mitchdenny) · 2026-01-19T00:10:41Z

/ba-g transient template failures.

Mitch Denny (mitchdenny)

Looks good.

github-actions · 2026-01-24T02:00:05Z

🎬 CLI E2E Test Recordings

The following terminal recordings are available for commit 157a72c:

Test	Recording
CreateAndDeployToDockerCompose	▶️ View Recording
CreateAndDeployToDockerComposeInteractive	▶️ View Recording
CreateAndRunAspireStarterProject	▶️ View Recording
CreateAndRunJsReactProject	▶️ View Recording
CreateAndRunPythonReactProject	▶️ View Recording
CreateEmptyAppHostProject	▶️ View Recording
CreateStartAndStopAspireProject	▶️ View Recording
CreateTypeScriptAppHostWithViteApp	▶️ View Recording
DoctorCommand_WithSslCertDir_ShowsTrusted	▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	▶️ View Recording
PsCommandListsRunningAppHost	▶️ View Recording

_{📹 Recordings uploaded automatically from CI run #21379107285}

David Fowler (davidfowl) · 2026-01-24T06:41:51Z

-                    logger.LogWarning("{Message}", message);
-
-                    // Send notification to the dashboard
-                    _ = interactionService.PromptNotificationAsync(


I moved where the check happens to DcpHost alongside the container runtime check.

Copilot · 2026-01-24T17:23:30Z

David Negstad (@danegsta) I've opened a new pull request, #14110, to work on those changes. Once the pull request is ready, I'll request review from you.

…il APIs with async/await (#14110)

David Fowler (davidfowl) · 2026-02-04T07:58:42Z

Damian Edwards (@DamianEdwards) can you try this out.

Damian Edwards (DamianEdwards) · 2026-02-04T15:51:08Z

✅ PR #13943 Validation Report - VERIFIED

PR Information

Title: Add logging if we detect the app host is running with an untrusted dev cert
Head Commit: 157a72cc734739e9bd3613abb5193cb646f64545
Tested At: 2026-02-04

CLI Version Verification

Expected Commit: 157a72cc
Installed Version: 13.2.0-pr.13943.g157a72cc
Status: ✅ Verified

Test Results

Scenario	Status	Notes
1. Basic Aspire Project Run	✅ Passed	2 resources running correctly
2. Untrusted Cert Notification	✅ Passed	Dashboard shows notification banner
3. Trusted Cert (Baseline)	✅ Passed	No notification when cert is trusted

Evidence

Scenario 2 - Untrusted Certificate:

Console: ⚠ Developer certificates may not be fully trusted (trust exit code was: 4)
Log: [Warning] Aspire.Hosting.Dcp.DcpHost: The most recent ASP.NET Core Development Certificate isn't fully trusted. Run 'dotnet dev-certs https --trust'...
Dashboard: Notification banner visible - "Development certificate not fully trusted"

Scenario 3 - Trusted Certificate:

Console: No cert warnings
Log: No cert warnings
Dashboard: No notification banner

Overall Result: ✅ PR VERIFIED

The PR correctly implements:

Warning-level logging when the dev cert is untrusted
Dashboard notification banner with actionable guidance (dotnet dev-certs https --trust)
No false positives when the certificate is properly trusted

📋 Full session log: https://gist.github.com/DamianEdwards/9a40bff87fcf4cb6bd37321673feab10

David Negstad (danegsta) · 2026-02-25T01:15:18Z

Replaced by #14666 targeting release/13.2.

Add logging if we detect the app host is running with an untrusted de…

364ac99

…v cert

Copilot AI review requested due to automatic review settings January 15, 2026 21:44

Copilot started reviewing on behalf of David Negstad (danegsta) January 15, 2026 21:44 View session

Copilot AI reviewed Jan 15, 2026

View reviewed changes

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Update src/Aspire.Hosting/DeveloperCertificateService.cs

2191b7d

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

github-actions Bot mentioned this pull request Jan 15, 2026

[pull requests] Review required #13834

Closed

David Negstad (danegsta) commented Jan 15, 2026

View reviewed changes

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Copilot AI mentioned this pull request Jan 15, 2026

Update DeveloperCertificateService to use 'AppHost:Directory' from configuration #13946

Closed

10 tasks

David Negstad (danegsta) added 3 commits January 15, 2026 15:51

Allow overriding the dev cert used by the dashboard

22ff768

Also notify the dashboard if the certificate isn't trusted

27c4ee4

Merge branch 'danegsta/trust' of github.com:dotnet/aspire into danegs…

9ee16ca

…ta/trust

David Negstad (danegsta) requested a review from Mitch Denny (mitchdenny) as a code owner January 16, 2026 00:29

David Negstad (danegsta) closed this Jan 16, 2026

David Negstad (danegsta) reopened this Jan 16, 2026

dotnet-policy-service Bot added this to the 13.2 milestone Jan 16, 2026

David Negstad (danegsta) added 7 commits January 16, 2026 12:54

Merge remote-tracking branch 'upstream/main' into danegsta/trust

effd859

Update trust check to handle MacOS

0d30edf

Add link to dev-certs code

19cb551

Cleanup some of the exceptions

45ea6a3

Move forward unlocking the macos keychain and trust the cert

f7b3ade

Merge branch 'danegsta/trust' of github.com:dotnet/aspire into danegs…

e255e12

…ta/trust

Trusting on Mac isn't going to be an option; switch to a warning in logs

d6f780d

Mitch Denny (mitchdenny) approved these changes Jan 19, 2026

View reviewed changes

James Newton-King (JamesNK) reviewed Jan 19, 2026

View reviewed changes

Comment thread src/Aspire.Hosting/Dashboard/DashboardEventHandlers.cs

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Merge branch 'main' into danegsta/trust

8c90f3e

David Negstad (danegsta) added 2 commits January 23, 2026 17:32

Use resource strings, move check and logging to DcpHost setup

360c705

Update how HTTPS check is determined

9165cfd

David Fowler (davidfowl) reviewed Jan 24, 2026

View reviewed changes

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

Use the file system service to get a temp folder

1a45c81

David Fowler (davidfowl) reviewed Jan 24, 2026

View reviewed changes

Comment thread src/Aspire.Hosting/DeveloperCertificateService.cs Outdated

David Fowler (davidfowl) reviewed Jan 24, 2026

View reviewed changes

Copilot AI mentioned this pull request Jan 24, 2026

Refactor DeveloperCertificateService to use ProcessSpec and ProcessUtil APIs with async/await #14110

Merged

10 tasks

Copilot AI and others added 3 commits January 24, 2026 14:03

Refactor DeveloperCertificateService to use ProcessSpec and ProcessUt…

c08965a

…il APIs with async/await (#14110)

Update test service mocks

b0816e0

Guard against the interaction service not being available

157a72c

David Negstad (danegsta) mentioned this pull request Feb 25, 2026

Add logging if we detect the app host is running with an untrusted dev cert #14666

Merged

16 tasks

David Negstad (danegsta) closed this Feb 25, 2026

dotnet-policy-service Bot modified the milestones: 13.2, 13.3 Feb 25, 2026

github-actions Bot locked and limited conversation to collaborators Mar 27, 2026

Uh oh!

Conversation

David Negstad (danegsta) commented Jan 15, 2026

Description

Checklist

Uh oh!

github-actions Bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Jan 15, 2026

Uh oh!

David Fowler (davidfowl) commented Jan 15, 2026

Uh oh!

David Negstad (danegsta) commented Jan 16, 2026

Uh oh!

Mitch Denny (mitchdenny) commented Jan 19, 2026

Uh oh!

Mitch Denny (mitchdenny) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jan 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎬 CLI E2E Test Recordings

Uh oh!

David Fowler (davidfowl) Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

David Negstad (danegsta) Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jan 24, 2026

Uh oh!

David Fowler (davidfowl) commented Feb 4, 2026

Uh oh!

Damian Edwards (DamianEdwards) commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ PR #13943 Validation Report - VERIFIED

PR Information

CLI Version Verification

Test Results

Evidence

Overall Result: ✅ PR VERIFIED

Uh oh!

David Negstad (danegsta) commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

github-actions Bot commented Jan 15, 2026 •

edited

Loading

github-actions Bot commented Jan 24, 2026 •

edited

Loading

Damian Edwards (DamianEdwards) commented Feb 4, 2026 •

edited

Loading