I'm trying to replicate what Visual Studio does on F5 debugging in my .net core api application.
It seems that "dotnet run --project" is the trick that I'm looking for except for one thing:
When I run with F5, it runs on https and it is trusted.
When I run with dotnet run, it runs on https and it is NOT trusted.
And I seem to be having problems using the application even though it seems to be running.
Any thoughts? I would like to do the same trick that F5 does just in order to test my application, however dotnet run must be missing some sort of certificate or something?
I really don't want to have to change my source code or to do anything with certs, again, because it is working as designed on F5, just need to do the same trick for dotnet run.
Based on the documentation here, it seems like you need to install and trust the development certificate:
.NET Core SDK includes a HTTPS development certificate. The certificate is installed as part of the first-run experience.
While the certificate is installed at this stage, it goes on to say that:
Installing the .NET Core SDK installs the ASP.NET Core HTTPS development certificate to the local user certificate store. The certificate has been installed, but it's not trusted. To trust the certificate perform the one-time step to run the dotnet dev-certs tool.
To trust it, you should use the following command:
dotnet dev-certs https --trust
This should show a dialog prompting you to trust the certificate. Once this is done, you can start your project running again, and restart your browsers. This should allow you to access the site on https://localhost:portnumber
Related
So I started working with asp.net core on my computer running arch linux. When I was on mac, to get dev-certs to work, I would run dotnet dev-certs https --trust in terminal to setup dev certs. This only works on osx and windows. To try and get the certificates working I tried to do the following things:
https://github.com/amadoa/dotnet-devcert-linux
https://bbs.archlinux.org/viewtopic.php?id=251330
These two solutions unfortunately did not work for me. Fortunately I found a workaround by allowing non secure connections over localhost in my browse, but I'm still wondering if anyone knows how to setup dev certs in arch linux?
I am deploying my API (ASP.NET Core 3.1) to a server and I am listening on https url only:
return WebHost.CreateDefaultBuilder(args)
.UseStartup<Startup>()
.UseUrls("http://*:5000;https://*:5001");
But I am getting and error:
crit: Microsoft.AspNetCore.Server.Kestrel[0]
Unable to start Kestrel.
System.InvalidOperationException: Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date.
In deployement, you make your self-signed ceritifate with:
...
dotnet dev-certs https --trust
...
But I cannot use it ofcourse because I have only runtime .Net Core and not SDK and it should be deployed app.
I have certificate file and key ssl.crt and ssl.key which I am using in my frontends apps (apache settings etc etc... you know what I mean).
Can I use it in ASP.NET or how do I do it?
Thanks
So as you can see in comments above (under question), there was a tip from Lex Li to listen on http:// and use proxyreverse to redirect https calls onto http.
But to be honest, this solution is little bit shady and I did not want to do it that way, so I continued my searching and found NuGet LettuceEncrypt which is actually solving my problem. I can now listen https calls, I dont need to use some shady solution with proxyreverse and also I dont have to install whole SDK to use dotnet dev-certs commands.
On github page I sent before is sample usage with 2 sample applications, so if you have similar problem, take a look at it and maybe it will wolve the problem for you too.
VS 2019 16.5.0 Preview 5
Windows 10
Chrome Version 80.0.3987.163 (Official Build) (64-bit)
I Googled this and am unable to find an answer.
I am trying to run a simple asp.net core MVC app with TLS on localhost.
What I did is I created a new project then in the project settings I enabled SSL and the URL I got I copied as App URL
App starts properly and TLS CA is not trusted? I followed the example here: https://stackoverflow.com/a/48790088/4950215 and I added the certificated Located in Personal/Certificates folder to Trusted Root Certification Authorities - Certificates manage computer certificates now showed that the CA is trusted.
I reloaded the app and I saw that the localhost SSL certificate used by Chrome is different than the one registered on my computer, and therefore the CA is still not trusted.
I have found the issue:
Basically, for whatever reason, I had a localhost installed on my LocalComputer store certificates. This made me think that Visual Studio created it, in reality VS creates certificates in the CurrentUser store, as visible by the open code in the dotnet repo.
Typically the procedure, for generating and TLS certificate by VS, is expected to go as such:
A .NET Project is marked as HTTPS, and you try to run it.
VS checks if a certificate is present in the CurrentUser store, asks to create one if it's not
User clicks YES, to creating a certificate, initially the certificate is installed in the CurrentUser/Personal/Certificates store
VS then sees that you do not have a localhost certificate in CurrentUser/TrustedRootCA/Certificates, and makes a prompt to ask you if you would like to install one, you click YES - everything is done.
Now if for some reason you are like me... and your CurrentUser/Trusted Root Certification Authority/Certificates is read only. Then you end up on the following line of the code:
case EnsureCertificateResult.FailedToTrustTheCertificate:
reporter.Warn("There was an error trusting HTTPS developer certificate.");
Because well step 4 failed...
To mitigate this:
Open the CurrentUser and LocalComputer stores. You can do that by following this microsoft guide, or just type certlm.msc and certmgr.msc in the Start.
Right click Export on the localhost certificate in CurrentUser store and export it as with the default options
Try importing the same certificate in the Trusted Root Certification Authorities/Certificates folder of the CurrentUser store.
If step 3 failed,which it should have because you wouldn't be in this predicament otherwise, import your certificate in the Trusted Root Certification Authorities/Certificates folder of the LocalComputer store.
Now everything should work. Hopefully you wouldn't have spent 6 hours on this, like I did.
In my case this worked:
Clean the old certificate and generate a new trusted one. Run the commands listed below:
dotnet dev-certs https --clean
dotnet dev-certs https --trust
Go to %APPDATA%\Microsoft\UserSecrets and delete all of the directories
Re-run the application. It should now run with no SSL errors
source: https://joeblogs.technology/2021/11/neterr_cert_date_invalid/
I am totally new to .NET and I came across one problem that is related to an agent application.
Its an IoT agent application which will be deployed and run Windows and Linux systems.
The application is a Web Service based application and uses HTTPS certificate to enable the secure communication between the clients and agent. When I tried to run the application on one of the system, I got error as
System.InvalidOperationException: Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found.
After going through most of the posts, I found that we need to download and install the 'dotnet' run time on the system and run below commands
dotnet dev-certs https
dotnet dev-certs https --check
However, for development environment its okay to run these commands. I am looking for a solution where we can run the application without download and installing the dotnet runtime environment.
What are the initial configuration settings those may required to run the application?
It's not the runtime you are missing (you wouldn't be able to execute the application and get the exception). You are missing a valid certificate for your server.
On a development machine you would issue the command
dotnet dev-certs https --trust
to install a trusted self signed certificate. On a production server you have to install a certificate from your certificate server or if it's public accessible from a trusted certificate authority.
Finally, able to run the application on Windows 7 and Windows 10 machine with the PFX certificate.
You need to generate the certificate. You may follow below link to generate the certificate.
https://www.sslsupportdesk.com/export-ssl-certificate-private-key-pfx-using-mmc-windows/
It is required to configure the Kestrel settings in JSON file. Below is the possible JSON configuration to use the certificate
{
"Kestrel": {
"Endpoints": {
"Https": {
"Url": "https://localhost:9448",
"Certificate": {
"Path": "path/to/certificate/file/your-cert.pfx",
"Password": "PwdOfCert",
"AllowInvalid": true
}
}
}
}
}
I am following an online tutorial to create an ASP.NET Core Web application. I followed everything but had trouble with trusting the local HTTPS certificate.
When I first run the application, I got an error saying:
"the access control list (acl) structure is invalid"
I tried googling this error but couldn't find anything related to my ASP.NET application, after cleaning the solution I didn't get this error any longer.
But I was unable to run my application in browser using HTTPS as it always says:
"This site is not secure"
I tried to trust certificate using CMD using this command:
dotnet dev-certs https --trust
It should show me a prompt to trust the certificate but it says "there was an error trusting the HTTPS developer certificate" and the application runs in an unsafe mode on the browser.
Can someone please help me run my application with HTTPS on my local environment? Any help will be greatly appreciated. Thanks
This seems to be a bug in ASP.NET Core 2.1:
what you need to do is go move your added certificates from your certificate manager.
go to start menu > Type "Win + R" type "certlm.msc", this will open your certificate manager.
go to Personal/Certificates
you will find a certificate named "localhost there.
Move that to "Trusted Root Certification Authorities/Certificates"
run the project again, and it should work.
Hope this helps.
I had the same problem in .NET 5. Running the command gave me the same error. After a few iterations I figured it out finally...
I was trying to create certificates manually through certlm.msc (local computer) but apparently the certificate should be created in certmgr.msc (current user). This is the place where the certificate gets saved when you run the command
dotnet dev-certs https --trust.
Windows + R and type certlm.msc
Go to Personal -> Certificates and export the localhost certificate with the same key (asks for password)
Go to Trusted Root Certification Authorities -> Certificates and right-click to click on Import
Browse and select the exported certificate
Place all certificates in the following store is selected and click on Browse again
Mark the checkbox: Show physical stores
Click on Trusted Root Certification Authorities and press on Local Computer
Finish everything
I had this issue in .net 6, solve it with help of this comment.
dotnet dev-certs https --clean
dotnet dev-certs https --trust
(maybe the clean is necessary as a first step...)
I have tried all the suggestions but eventually, The below solution worked for me.
Uninstall IIS Express via Add Remove Program
Run command: dotnet dev-certs https --clean
Re-install IIS Express by downloading it from the Microsoft website
Run the Asp.Net application from Visual Studio
Visual studio will prompt for generating a certificate, click yes.
In my case, it generated the certificate but failed to add the certificate to the trusted root with an error 'Access Denied'
Windows + R and type mmc
File > Add Snap-In
Select Certificates and click add
Select the 'Computer account' option and click finish, then click Ok.
Then expand the certificates(Local Computer) > Personal > Certificates
You will find a local host certificate with the friendly name 'ISS Express Development Certificate'
Select the certificate then cut and paste it into Trusted Root Certification Authorities -> Certificates