How to run 'dotnet dev-certs https --trust'?

On Ubuntu the standard mechanism would be:

• dotnet dev-certs https -v to generate a self-signed cert
• convert the generated cert in ~/.dotnet/corefx/cryptography/x509stores/my from pfx to pem using openssl pkcs12 -in <certname>.pfx -nokeys -out localhost.crt -nodes
• copy localhost.crt to /usr/local/share/ca-certificates
• trust the certificate using sudo update-ca-certificates
• verify if the cert is copied to /etc/ssl/certs/localhost.pem (extension changes)
• verify if it's trusted using openssl verify localhost.crt

Unfortunately this does not work:

• dotnet dev-certs https generates certificates that are affected by the issue described on https://github.com/openssl/openssl/issues/1418 and https://github.com/dotnet/aspnetcore/issues/7246:

$ openssl verify localhost.crt
CN = localhost
error 20 at 0 depth lookup: unable to get local issuer certificate
error localhost.crt: verification failed

• due to that it's impossible to have a dotnet client trust the certificate

Workaround: (tested on Openssl 1.1.1c)

1. manually generate self-signed cert
2. trust this cert
3. force your application to use this cert

In detail:

1. manually generate self-signed cert:

   • create localhost.conf file with the following content:

[req]
default_bits       = 2048
default_keyfile    = localhost.key
distinguished_name = req_distinguished_name
req_extensions     = req_ext
x509_extensions    = v3_ca

[req_distinguished_name]
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_default          = localhost
commonName_max              = 64

[req_ext]
subjectAltName = @alt_names

[v3_ca]
subjectAltName = @alt_names
basicConstraints = critical, CA:false
keyUsage = keyCertSign, cRLSign, digitalSignature,keyEncipherment

[alt_names]
DNS.1   = localhost
DNS.2   = 127.0.0.1

• generate cert using openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out localhost.crt -config localhost.conf
• convert cert to pfx using openssl pkcs12 -export -out localhost.pfx -inkey localhost.key -in localhost.crt
• (optionally) verify cert using openssl verify -CAfile localhost.crt localhost.crt which should yield localhost.crt: OK
• as it's not trusted yet using openssl verify localhost.crt should fail with

CN = localhost
error 18 at 0 depth lookup: self signed certificate
error localhost.crt: verification failed

2. trust this cert:

   • copy localhost.crt to /usr/local/share/ca-certificates
   • trust the certificate using sudo update-ca-certificates
   • verify if the cert is copied to /etc/ssl/certs/localhost.pem (extension changes)
   • verifying the cert without the CAfile option should work now

$ openssl verify localhost.crt 
localhost.crt: OK

3. force your application to use this cert

   • update your appsettings.json with the following settings:

"Kestrel": {
  "Certificates": {
    "Default": {
      "Path": "localhost.pfx",
      "Password": ""
    }
  }
}

While the answer provided by @chrsvdb is helpful it does not solve all problems. I still had issue with service-to-service communication (HttpClient - PartialChain error) and also you must reconfigure Kestrel to use your own certificate. It is possible to create a self-signed certificate and import it to the .NET SDK. All you need is to specify the 1.3.6.1.4.1.311.84.1.1 extension in the certificate.

After that the cert can be imported into .NET Core SDK and trusted. Trusting in Linux is a bit hard as each application can have it's own certificate store. E.g. Chromium and Edge use nssdb which can be configured with certutil as described John Duffy. Unfortunately the location to the nssdb maybe different when you install application as snap. Then each application has its own database. E.g. for Chromium Snap the path will be $HOME/snap/chromium/current/.pki/nssdb, for Postman Snap the will be $HOME/snap/postman/current/.pki/nssdb and so on.

Therefor I have created a script which generates the cert, trusts it for Postman Snap, Chmromium Snap, current user nssdb and on system level. It also imports the script into the .NET SDK so it will be used by ASP.NET Core without changing the configuration. You can find more informations about the script in my blog post https://blog.wille-zone.de/post/aspnetcore-devcert-for-ubuntu

For Chrome:

1. Click "Not Secure" in address bar.
2. Click Certificate.
3. Click Details.
4. Click Export.

Run: certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n {FILE_NAME} -i {FILE_NAME}

Restart Chrome.

In adition to crisvdb answer, I've several information to add and is the continuation of the walktrough. I don't comment because is pretty complex comment this, but before this answer take a look to crisvdb answer first and then return to continue.

Take the "in detail" crisdb answer.

1. You can make your cert in any folder, can be or can't be in the same folder of the app.
2. Take openssl verify -CAfile localhost.crt localhost.crt as not optional step, mandatory. It will help.
3. Do not recompile or touch the code meanwhile you are doing this, in order to get first scenario clean.
4. If you run sudo update-ca-certificates that will answer you in wich folder the certified should be copied.
5. In some distributions, as Raspbian for Raspberry Pi, CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/ and in some cases /usr/local/share/certificates.
6. Do not copy the cert manually to trusted certs, run sudo update-ca-certificates after you copy the cert in the right folder. If it doesn't work (doesn't update or add any certificate) copy it to every folder possible.
7. If you use a password while making the certificate, you should use it in the appsettings.json
8. If you get this error:

Interop+Crypto+OpenSslCryptographicException: error:2006D002:BIO routines:BIO_new_file:system lib

Take in consideration that error means "access denied". It can be because you don't have permissions or related.

7b) Could be also that the file is not found, I use the entire path in the config:

 "Path": "/home/user/www/myfolder1/myapp/localhost.pfx",

8. After that, and if everything works, you could see a 500 error if you are using Apache or Apache2.

If you get the following error in the apache logs of the site:

[ssl:error] [remote ::1:yourport] AH01961: SSL Proxy requested for yoursite.com:443 but not enabled [Hint: SSLProxyEngine] [proxy:error] AH00961: HTTPS: failed to enable ssl support for [::1]:yourport (localhost)

you must set in the VirtualHost the following configuration after SSLEngine On and before your ProxyPass

SSLProxyEngine on

9. After that, and if everything works, you could see a 500 error if you are using Apache or Apache2.

If you get the following error in the apache logs of the site:

[proxy:error] [client x.x.x.x:port] AH00898: Error during SSL Handshake with remote server returned by / [proxy_http:error] [client x.x.x.x:port] AH01097: pass request body failed to [::1]:port (localhost) from x.x.x.x()

you must set in the VirtualHost the following configuration after SSLProxyEngine on and before your ProxyPass

SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off

UPDATE

If you are renovating this, and using the same names, take in consideration that you should remove your pem file from etc/ssl/certs

UPDATE 2
If it returns:

Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:2006D002:BIO routines:BIO_new_file:system lib

Check that your pfx file is on 755 permissions.

If appsettings.json seems to be don't load (on port 5000 by default or SQL or any configuration doesn't load or can't be read), take in consideration that the dotnet must be executed on the same directory where is appsettings.json

Looks like this is a known issue with dotnet global tools and that specific command is only available for MacOS and Windows. See this issue on github: Issue 6066.

It seems like there may be a work around for Linux users based on this SO post: ASP.Net Core application service only listening to Port 5000 on Ubuntu.

Here are the total steps I took to allow my dotnet web applications to run in Chrome secure. (This is a combination of previous steps and a couple of other steps I need to take)

Ubuntu ver. 24.04 / Dotnet ver. 9.0.3 / Chrome ver. 134.0.69

1. Change directory to home (~/)

2. Create localhost.conf file in home directory with these contents:
[req]
default_bits       = 2048
default_keyfile    = localhost.key
distinguished_name = req_distinguished_name
req_extensions     = req_ext
x509_extensions    = v3_ca

[req_distinguished_name]
commonName                  = Common Name (e.g. server FQDN or YOUR name)
commonName_default          = localhost
commonName_max              = 64

[req_ext]
subjectAltName = @alt_names

[v3_ca]
subjectAltName = @alt_names
basicConstraints = critical, CA:false
keyUsage = keyCertSign, cRLSign, digitalSignature,keyEncipherment

[alt_names]
DNS.1   = localhost
DNS.2   = 127.0.0.1

!!Note in one of these process you will be asked for the password. Remember this password to use in the appsettings.json file.
3. Generate cert: openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout localhost.key -out localhost.crt -config localhost.conf

4. Convert cert to pfx: openssl pkcs12 -export -out localhost.pfx -inkey localhost.key -in localhost.crt

5. Verify cert (Should fail; not trusted yeet): openssl verify -CAfile localhost.crt localhost.crt
CN = localhost
error 18 at 0 depth lookup: self signed certificate
error localhost.crt: verification failed

6. Trust the cert:
  a. Copy localhost.crt to /usr/local/share/ca-certificates: sudo cp localhost.crt /usr/local/share/ca-certificates
  b. Trust the certificate: sudo update-ca-certificates
  c. Verify that localhost.pem exists in /etc/ssl/certs/: sudo ll /etc/ssl/certs/localhost.pem.
  d. Verify the cert without the CAfile option: openssl verify localhost.crt 
     Response should be: localhost.crt: OK

7. Trust certificate for DOTNET.
  a. Change directory to home: cd ~/
  b. Clean the DOTNET self-signed certificate: sudo dotnet dev-certs https --clean
  c. Check the DOTNET self-signed certificate (There should be no certificate): sudo dotnet dev-certs https --check
  d. Trust the UBUNTU self-signed certficate: sudo dotnet dev-certs https --trust
  e. Check the DOTNET self-signed certificate: sudo dotnet dev-certs https --check

8. Add self-signed certificate setting to appsettings.json:
"Kestrel": {
  "Certificates": {
    "Default": {
      "Path": "localhost.pfx",
      "Password": "<cert password>"
    }
  }
}

9. Run DOTNET application: <main directory>/dotnet run ex. API/dotnet run.

10. Update Chrome:
  a. From Chome click on "Not Secure".
  b. Select Certificate Details.
  c. Select the Details tab.
  d. Click on Export.
  e. Run: certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n {EXPORT FILE NAME} -i {EXPORT FILE NAME}
  f. Restart Chrome.