{"record":{"id":"8d472eb65c61b4b3","repo":"microsoft/aspire","slug":"the-provided-certificate-is-invalid","errorCode":null,"errorMessage":"The provided certificate is invalid.","messagePattern":"The provided certificate is invalid\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting/ApplicationModel/HttpsCertificateAnnotation.cs","lineNumber":47,"sourceCode":"            {\n                throw new ArgumentException(\"Cannot set both UseDeveloperCertificate and Certificate properties.\", nameof(value));\n            }\n\n            if (value?.HasPrivateKey == false)\n            {\n                throw new ArgumentException(\"The provided certificate must have a private key.\", nameof(value));\n            }\n\n            try\n            {\n                if (value != null && value.PublicKey == null)\n                {\n                    throw new ArgumentException(\"The provided certificate must have a valid public key.\", nameof(value));\n                }\n            }\n            catch (CryptographicException ex)\n            {\n                throw new ArgumentException(\"The provided certificate is invalid.\", nameof(value), ex);\n            }\n\n            _certificate = value;\n        }\n    }\n\n    /// <summary>\n    /// Gets or sets a value indicating whether the resource should use a platform developer certificate for its key pair.\n    /// </summary>\n    public bool? UseDeveloperCertificate\n    {\n        get => _useDeveloperCertificate;\n        init\n        {\n            _useDeveloperCertificate = value;\n            if (value == true && _certificate != null)\n            {\n                throw new ArgumentException(\"Cannot set both UseDeveloperCertificate and Certificate properties.\", nameof(value));","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting/ApplicationModel/HttpsCertificateAnnotation.cs#L29-L65","documentation":"The Certificate init accessor wraps public-key inspection in try/catch; if reading the certificate's key data throws CryptographicException, the annotation rethrows it as ArgumentException('The provided certificate is invalid.') with the original exception as InnerException. This indicates the certificate bytes could not be interpreted at all.","triggerScenarios":"Assigning an X509Certificate2 constructed from malformed DER/PEM bytes, a password-protected PFX loaded with a wrong/missing password that surfaces later, or an unsupported key algorithm to HttpsCertificateAnnotation.Certificate.","commonSituations":"Secrets manager or env var containing the wrong blob (e.g. a CSR instead of a cert); CRLF/whitespace damage from templating; legacy crypto algorithm unsupported by the current platform/OpenSSL.","solutions":["Inspect InnerException (CryptographicException) to identify the real decode failure and fix the certificate bytes or password accordingly.","Validate the file locally before deployment: openssl pkcs12 -in cert.pfx -passin pass:... -nokeys and openssl x509 -in cert.pem -noout.","Re-export to a standard PFX (PKCS#12) with modern encryption (AES) and re-provision the secret.","Catch ArgumentException around annotation construction and fail startup with the inner cryptographic detail logged."],"exampleFix":"// before\nvar cert = new X509Certificate2(certBytes, badPassword);\nvar annotation = new HttpsCertificateAnnotation { Certificate = cert }; // ArgumentException 'certificate is invalid'\n// after\nvar cert = new X509Certificate2(certBytes, resolvedPassword);\nvar annotation = new HttpsCertificateAnnotation { Certificate = cert };","handlingStrategy":"try-catch","validationCode":"// probe the cert before constructing the annotation\ntry { _ = new X509Certificate2(certBytes, password); }\ncatch (CryptographicException ce)\n{\n    throw new InvalidOperationException(\"Certificate bytes/password are invalid: \" + ce.Message, ce);\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    var annotation = new HttpsCertificateAnnotation { Certificate = cert };\n}\ncatch (ArgumentException ex) when (ex.Message.Contains(\"certificate is invalid\"))\n{\n    var root = ex.InnerException as CryptographicException; // log and fail with detail\n}","preventionTips":["Validate cert files/passwords locally with openssl before provisioning.","Log InnerException (CryptographicException) to pinpoint the decode failure.","Use standard PKCS#12/AES exports and current password handling.","Confirm the secret payload is the certificate, not a CSR or public-only blob."],"tags":["dotnet","aspire","https","certificate","x509"],"backgroundTag":"invalid-argument-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}