I'm new in ASP.NET.
Environment:
Ubuntu 18.04
Visual Studio Code
.NET SDK 2.2.105
I'm in trouble with some command running.
I was reading tutorial at
https://learn.microsoft.com/ja-jp/aspnet/core/tutorials/razor-pages/razor-pages-start?view=aspnetcore-2.2&tabs=visual-studio-code
and ran this command:
dotnet dev-certs https --trust
I expect https://localhost should be trusted.
but I found the error message;
$ Specify --help for a list of available options and commands.
It seems that the command "dotnet dev-certs https" has no --trust options.
How to resolve this problem?
On Ubuntu the standard mechanism would be:
dotnet dev-certs https -v to generate a self-signed cert
convert the generated cert in ~/.dotnet/corefx/cryptography/x509stores/my from pfx to pem using openssl pkcs12 -in <certname>.pfx -nokeys -out localhost.crt -nodes
copy localhost.crt to /usr/local/share/ca-certificates
trust the certificate using sudo update-ca-certificates
verify if the cert is copied to /etc/ssl/certs/localhost.pem (extension changes)
verify if it's trusted using openssl verify localhost.crt
Unfortunately this does not work:
dotnet dev-certs https generates certificates that are affected by the issue described on https://github.com/openssl/openssl/issues/1418 and https://github.com/dotnet/aspnetcore/issues/7246:
$ openssl verify localhost.crt
CN = localhost
error 20 at 0 depth lookup: unable to get local issuer certificate
error localhost.crt: verification failed
due to that it's impossible to have a dotnet client trust the certificate
Workaround: (tested on Openssl 1.1.1c)
manually generate self-signed cert
trust this cert
force your application to use this cert
In detail:
manually generate self-signed cert:
create localhost.conf file with the following content:
[req]
default_bits = 2048
default_keyfile = localhost.key
distinguished_name = req_distinguished_name
req_extensions = req_ext
x509_extensions = v3_ca
[req_distinguished_name]
commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_default = localhost
commonName_max = 64
[req_ext]
subjectAltName = #alt_names
[v3_ca]
subjectAltName = #alt_names
basicConstraints = critical, CA:false
keyUsage = keyCertSign, cRLSign, digitalSignature,keyEncipherment
[alt_names]
DNS.1 = localhost
DNS.2 = 127.0.0.1
generate cert using openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out localhost.crt -config localhost.conf
convert cert to pfx using openssl pkcs12 -export -out localhost.pfx -inkey localhost.key -in localhost.crt
(optionally) verify cert using openssl verify -CAfile localhost.crt localhost.crt which should yield localhost.crt: OK
as it's not trusted yet using openssl verify localhost.crt should fail with
CN = localhost
error 18 at 0 depth lookup: self signed certificate
error localhost.crt: verification failed
trust this cert:
copy localhost.crt to /usr/local/share/ca-certificates
trust the certificate using sudo update-ca-certificates
verify if the cert is copied to /etc/ssl/certs/localhost.pem (extension changes)
verifying the cert without the CAfile option should work now
$ openssl verify localhost.crt
localhost.crt: OK
force your application to use this cert
update your appsettings.json with the following settings:
"Kestrel": {
"Certificates": {
"Default": {
"Path": "localhost.pfx",
"Password": ""
}
}
}
While the answer provided by #chrsvdb is helpful it does not solve all problems. I still had issue with service-to-service communication (HttpClient - PartialChain error) and also you must reconfigure Kestrel to use your own certificate. It is possible to create a self-signed certificate and import it to the .NET SDK. All you need is to specify the 1.3.6.1.4.1.311.84.1.1 extension in the certificate.
After that the cert can be imported into .NET Core SDK and trusted. Trusting in Linux is a bit hard as each application can have it's own certificate store. E.g. Chromium and Edge use nssdb which can be configured with certutil as described John Duffy. Unfortunately the location to the nssdb maybe different when you install application as snap. Then each application has its own database. E.g. for Chromium Snap the path will be $HOME/snap/chromium/current/.pki/nssdb, for Postman Snap the will be $HOME/snap/postman/current/.pki/nssdb and so on.
Therefor I have created a script which generates the cert, trusts it for Postman Snap, Chmromium Snap, current user nssdb and on system level. It also imports the script into the .NET SDK so it will be used by ASP.NET Core without changing the configuration. You can find more informations about the script in my blog post https://blog.wille-zone.de/post/aspnetcore-devcert-for-ubuntu
In adition to crisvdb answer, I've several information to add and is the continuation of the walktrough. I don't comment because is pretty complex comment this, but before this answer take a look to crisvdb answer first and then return to continue.
Take the "in detail" crisdb answer.
You can make your cert in any folder, can be or can't be in the same folder of the app.
Take openssl verify -CAfile localhost.crt localhost.crt as not optional step, mandatory. It will help.
Do not recompile or touch the code meanwhile you are doing this, in order to get first scenario clean.
If you run sudo update-ca-certificates that will answer you in wich folder the certified should be copied.
In some distributions, as Raspbian for Raspberry Pi, CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/ and in some cases /usr/local/share/certificates.
Do not copy the cert manually to trusted certs, run sudo update-ca-certificates after you copy the cert in the right folder. If it doesn't work (doesn't update or add any certificate) copy it to every folder possible.
If you use a password while making the certificate, you should use it in the appsettings.json
If you get this error:
Interop+Crypto+OpenSslCryptographicException: error:2006D002:BIO
routines:BIO_new_file:system lib
Take in consideration that error means "access denied". It can be because you don't have permissions or related.
7b) Could be also that the file is not found, I use the entire path in the config:
"Path": "/home/user/www/myfolder1/myapp/localhost.pfx",
After that, and if everything works, you could see a 500 error if you are using Apache or Apache2.
If you get the following error in the apache logs of the site:
[ssl:error] [remote ::1:yourport] AH01961: SSL Proxy requested for
yoursite.com:443 but not enabled [Hint: SSLProxyEngine] [proxy:error]
AH00961: HTTPS: failed to enable ssl support for [::1]:yourport
(localhost)
you must set in the VirtualHost the following configuration after SSLEngine On and before your ProxyPass
SSLProxyEngine on
After that, and if everything works, you could see a 500 error if you are using Apache or Apache2.
If you get the following error in the apache logs of the site:
[proxy:error] [client x.x.x.x:port] AH00898: Error during SSL
Handshake with remote server returned by /
[proxy_http:error] [client x.x.x.x:port] AH01097: pass request body failed to [::1]:port
(localhost) from x.x.x.x()
you must set in the VirtualHost the following configuration after SSLProxyEngine on and before your ProxyPass
SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
UPDATE
If you are renovating this, and using the same names, take in consideration that you should remove your pem file from etc/ssl/certs
UPDATE 2
If it returns:
Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:2006D002:BIO routines:BIO_new_file:system lib
Check that your pfx file is on 755 permissions.
If appsettings.json seems to be don't load (on port 5000 by default or SQL or any configuration doesn't load or can't be read), take in consideration that the dotnet must be executed on the same directory where is appsettings.json
Looks like this is a known issue with dotnet global tools and that specific command is only available for MacOS and Windows. See this issue on github: Issue 6066.
It seems like there may be a work around for Linux users based on this SO post: ASP.Net Core application service only listening to Port 5000 on Ubuntu.
For Chrome:
Click "Not Secure" in address bar.
Click Certificate.
Click Details.
Click Export.
Run: certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n {FILE_NAME} -i {FILE_NAME}
Restart Chrome.
It looks like the following could help to trust the dotnet dev certs:
https://blog.wille-zone.de/post/aspnetcore-devcert-for-ubuntu/
Then you will see also in the browser that certificate is OK and valid for the next yeat.
Give it a try...
Good luck!
I created a Self Signed Certificate for my internal development purpose using MakeCert.exe
Step #1:
I Created a Root CA using the following Command
makecert -n "CN=Bala root signing authority" -cy authority -r -sv root.pvk root.cer
Step #2:
Installed the Root CA Certificate which is created in Step #1 using the following Command
certutil -user -addstore Root root.cer
Step #3:
I Created a Client Certificate using the following Command
makecert -pe -n "CN=Bala Client" -a sha1 -cy end ^ -sky signature ^ -ic root.cer -iv root1.pvk ^ -sv Bala.pvk Bala.cer
Step #4:
I Created a .pfx file for the respective Client Certificate using the following command
pvk2pfx -pvk Bala.pvk -spc Bala.cer -pfx Bala.pfx
The Root CA namely "CN=Bala root signing authority" has all intended purpose and its installed in Trusted Root Certification Authorities
Snapshot of Root CA Certificate: "CN=Bala root signing authority"
Snapshot of Client Certificate: "CN=Bala Client"
The Client Certificate has a ThumbPrint: "83021C2C20096FFD8415A353E471FF1BD39ECA4E"
Kindly look at the snapshot:
I'm having a Client in my IdentityServer3 and I used the Same thumbprint "83021C2C20096FFD8415A353E471FF1BD39ECA4E"
new Client
{
ClientName = "Client Credentials Flow Client With Certificate",
Enabled = true,
ClientId = "cc.WithCertificate",
Flow = Flows.ClientCredentials,
ClientSecrets = new List<Secret>
{
new Secret
{
Value = "83021C2C20096FFD8415A353E471FF1BD39ECA4E",
Type = Constants.SecretTypes.X509CertificateThumbprint,
Description = "Client Certificate"
},
},
AllowedScopes = new List<string>
{
"read"
}
}
The Client Console Application Code is
var cert = new X509Certificate2(#"Bala.pfx");
var handler = new WebRequestHandler();
handler.ClientCertificates.Add(cert);
string tokenEndPoint = ConfigurationManager.AppSettings["TokenEndpoint"];
var client = new TokenClient(
tokenEndPoint,
"cc.WithCertificate",
handler);
// Calling the Token Service
var response = client.RequestClientCredentialsAsync("read").Result;
Response Object's Snapshot:
Once I execute the code I'm getting the response with an Error Status Code: response.Error ="Forbidden"
I followed all the per-requesite setup which is said in my previous question response.Error "Forbidden" in IdentityServer3 Flows.ClientCredentials
Kindly assist me how to Authenticate the application using Self Signed Certificate.
I found the solution for this issue (Self Signed Certificate) after a long struggle. There is a way to use the Self Signed Certificate in an Identity Server for authenticating user based on Client Certificate.
In the Identity Server, we are using a Certificate for generating Tokens (by default we are using idsrv3test.pfx) and in Client Application we are using the Certificate Client.pfx (by default). I researched the logic behind in this, I found the solution these two certificates has a common Issuer "DevRoot". The Identity Server return the Token based on Client Certificate only if the DevRoot is in Trusted Root Certification Authorities otherwise the IIS should not allow the request and return back with status code 403 Forbidden.
Scenario #1:
Scenario #2:
I followed the same logic, I created a Root CA Certificate. Moreover I created Server and Client Certificate and I mapped those certificate with the Root CA Certificate (i.e., Parent). The Certificates should have the following purpose
Root CA Certificate => All Purpose or the combination of Server Authentication and Client Authentication
Server Certificate => Only Server Authentication Purpose
Client Certificate => Only Client
Note: For more information about Intended Purpose, refer
http://www.alvestrand.no/objectid/1.3.6.1.5.5.7.3.html
The Server and Client Certificate should be in .pfx file format. Let us see how to create the said Certificates
Ensure the Prerequisite Tools is exist in your System before executing the following Command
Install the latest .Net Framework https://www.microsoft.com/net/download
Install the Latest Microsoft Windows SDK for Windows 7 and .NET
Framework 4 https://www.microsoft.com/en-us/download/details.aspx?id=8279
Step: #1
We need to Create a Certificates of CA, Service and Client along with Private Key
Certificate Authority
makecert -r -pe -n "CN=Token Root CA"
-sr LocalMachine -a sha1 -sky signature -cy authority -sv
"D:\Certificate\IDRootCA.pvk" "D:\Certificate\IDRootCA.cer"
Server Certificate
makecert -pe -n "CN=Server - Token Identity" -a sha1 -sky exchange
-eku 1.3.6.1.5.5.7.3.1 -ic "D:\Certificate\IDRootCA.cer" -iv
"D:\Certificate\IDRootCA.pvk" -sv "D:\Certificate\IDServer.pvk" "D:\Certificate\IDServer.cer"
Client Certificate
makecert -pe -n "CN=Client - Token Identity" -a sha1 -sky exchange
-eku 1.3.6.1.5.5.7.3.2 -ic "D:\Certificate\IDRootCA.cer" -iv
"D:\Certificate\IDRootCA.pvk" -sv "D:\Certificate\IDClient.pvk" "D:\Certificate\IDClient.cer"
Step: #2
We need to Export the PFX's file of Service and Client certificate
Service Certificate (PFX Format)
pvk2pfx -pvk "D:\Certificate\IDServer.pvk" -spc "D:\Certificate\IDServer.cer"
-pfx "D:\Certificate\IDServer.pfx"
Client Certificate (PFX Format)
pvk2pfx -pvk "D:\Certificate\IDClient.pvk" -spc "D:\Certificate\IDClient.cer"
-pfx "D:\Certificate\IDClient.pfx"
Step: #3
We need to Import CA into Trusted Root Certification Authorities certificate store
Import Certificate Authority "CN=Token Root CA"
certutil -user -addstore Root "D:\Certificate\IDRootCA.cer"
Note: Here I import the Certificate only for the current user "-user".
For more details refer
http://certificate.fyicenter.com/685_Microsoft_CertUtil_Microsoft_certutil_-user_Certificate_St.html
Execute all the above said commands using Command Prompt in Administrator Mode and navigate the path to "C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin". The said path should contain the MakeCert.exe file (Ensure it once)
The above said Commands will create all the required Certificates of Identity Server
Identity Server Project:
Kindly use the Server Certificate "IDServer.pfx" instead of "idsrv3test.pfx" and Change the same in Certificates.cs and Web.config.
Note: The Private key is not required for this Self signed
Certificate.
Finally the Client Console Application Code is
var cert = new X509Certificate2(#"IDClient.pfx");
var handler = new WebRequestHandler();
handler.ClientCertificates.Add(cert);
string tokenEndPoint = ConfigurationManager.AppSettings["TokenEndpoint"];
var client = new TokenClient(
tokenEndPoint,
"cc.WithCertificate",
handler);
// Calling the Token Service
var response = client.RequestClientCredentialsAsync("read").Result;
Finally I got the Access Token Successfully
I created a self sign certificate using the following steps:
Create a Root certificate authority
makecert -pe -n "CN=RootCertificate" -ss root -sr LocalMachine -sky signature -r "RootCertificate.cer"
Create an SSL certificate
makecert -pe -n "CN=SSLCertificate" -ss my -sr LocalMachine -sky exchange -eku 1.3.6.1.5.5.7.3.3 -in "RootCertificate" -is root -ir LocalMachine -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 SSLCertificate.cer
Confirm RootCertifcate under Trusted Root Certificate, confirm SSLCertificate sits under Personal Certificates.
I exported SSLCertificate into SSLCertificate.pfx file using MMC GUI.
I import SSLCertificate.pfx into a server computer.
I bind this certificate to port 998 using the command:
netsh http add sslcert ipport=0.0.0.0:998 certhash=764f3bef8cf4d72c5cd077da5b0efbec1b3830a5 appid={3fc1e120-6d8d-477e-ad09-67d749e65d83}
I have an application that hosts its own HTTP Listner on port 998. I verified it works because I can browse to https://server_ip:998
My question is: This server is currently on its own, what if it is part of the domain, would my step 1 - 6 be enough? In my opinion i think it should be but then again I'm not very familiar with the network side and there is no domain for me to test this out.
I am not using IIS to host but rather it is a C# form application that hosts this HTTP Listener.
When I try to run mi compiled application Windows advertises that the APP don't have any signature and asks if I really want to run my app.
I don't know the reason wich causes that but I think to avoid this I need a digital signature, so from the web I followed this steps:
I've created my own cert with the makecert tool from Windows SDK's, following a example with this code:
makecert -r -pe -a sha1 -n "CN=name, E=name#Hotmail.com, C=US" -b 01/01/2013 -e 01/01/2050 -ss My
Then I can see my own certificate in the "Personal" Folder:
Now I've exported the certificate with this command:
certutil -exportPFX -p "Password" my 586a7358ebdce8854def26875f0f38ab "C:\Test.pfx"
But when I opened the signing tab in my project setings and choosed "Select from file...", VS says this:
The selected certificate is not valid for code-signing. Choose another certificate file.
I did bad something? I don't know how to correctly code-sign my project,
maybe I need a ".cer" certificate instead a ".pfx" certificate?
then how I can generate a valid CER certificate?
I’m trying to write a server application that uses SSL to communicate. After accepting a connection, I believe I have to call SslStream.AuthenticateAsServer. However, this expects a certificate and I do not understand how to create one.
I followed the advice given in the answer to this question:
I ran the following to create a server.pfx file:
makecert.exe -r -pe -n "CN=localhost" -sky exchange -sv server.pvk
server.cer pvk2pfx -pvk server.pvk -spc server.cer -pfx server.pfx
Then I loaded it in code with:
certificate = new X509Certificate2("server.pfx", "password");
However, I did that exactly, and I get a CryptographicException saying “The specified network password is not correct.”, which is patently false because I used the password x, which is very hard to mistype. What am I doing wrong?
How to: Create Your Own Test Certificate