dotnet-devcert-trust

1# .NET Dev Certificate Trust on Linux
2 
3## When to Use This Skill
4 
5Use this skill when:
6- Redis TLS connections fail with `UntrustedRoot` or `RemoteCertificateNameMismatch` in Aspire
7- `dotnet dev-certs https --check --trust` returns exit code 7
8- HTTPS localhost connections fail with certificate validation errors
9- After running `dotnet dev-certs https --clean` and needing to restore trust
10- Setting up a new Linux dev machine for .NET HTTPS development
11- Aspire dashboard or inter-service gRPC calls fail with TLS errors
12- Upgrading from Aspire < 13.1.0 (which didn't use TLS on Redis by default)
13 
14## The Problem
15 
16On Windows and macOS, `dotnet dev-certs https --trust` handles everything automatically — it generates the certificate, installs it in the user store, and adds it to the system trust store. On Linux, **it does almost nothing useful**. The command generates the cert and places it in the user store, but:
17 
181. It does **not** export the certificate to the system CA directory
192. It does **not** run `update-ca-certificates` to rebuild the CA bundle
203. It does **not** add the cert to browser trust stores (NSS/NSSDB)
214. The `--trust` flag silently succeeds but the cert remains untrusted
22 
23This means .NET applications, OpenSSL, curl, and browsers all reject the dev certificate — even though `dotnet dev-certs https --check` reports it exists.
24 
25### Why This Surfaces with Aspire 13.1.0+
26…