{"record":{"id":"c16e198f26853966","repo":"microsoft/aspire","slug":"no-fully-trusted-exportable-developer-certificate-with-a","errorCode":null,"errorMessage":"No fully trusted exportable developer certificate with a private key was found.","messagePattern":"No fully trusted exportable developer certificate with a private key was found\\.","errorType":"exception","errorClass":"DcpDeveloperCertificateUnavailableException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Cli/Utils/EnvironmentChecker/DcpConnectionChecker.cs","lineNumber":421,"sourceCode":"                .TakeLast(40)\n                .Select(line => $\"{line.Stream}: {line.Line}\")\n                .ToArray();\n\n            return lines.Length == 0 ? DoctorCommandStrings.DcpNoOutputDetails : string.Join(Environment.NewLine, lines);\n        }\n\n        private static void AddDeveloperCertificateArguments(List<string> arguments, CertificateManager certificateManager, IEnvironment environment)\n        {\n            var certificates = certificateManager.ListCertificates(StoreName.My, StoreLocation.CurrentUser, isValid: true);\n            try\n            {\n                var certificate = certificates.FirstOrDefault(c =>\n                    c.HasPrivateKey &&\n                    certificateManager.GetTrustLevel(c) == CertificateManager.TrustLevel.Full);\n\n                if (certificate is null)\n                {\n                    throw new DcpDeveloperCertificateUnavailableException(DoctorCommandStrings.DcpDeveloperCertificateNoTrustedExportableDetails);\n                }\n\n                if (string.IsNullOrWhiteSpace(certificate.Thumbprint))\n                {\n                    throw new DcpDeveloperCertificateUnavailableException(DoctorCommandStrings.DcpDeveloperCertificateMissingThumbprintDetails);\n                }\n\n                arguments.Add(\"--tls-cert-thumbprint\");\n                arguments.Add(certificate.Thumbprint);\n\n                if (environment.IsWindows())\n                {\n                    return;\n                }\n\n                var certificatePath = DcpDeveloperCertificateCache.EnsureDeveloperCertificateCache(certificateManager, certificate);\n                var keyPath = Path.ChangeExtension(certificatePath, \".key\");\n","sourceCodeStart":403,"sourceCodeEnd":439,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Cli/Utils/EnvironmentChecker/DcpConnectionChecker.cs#L403-L439","documentation":"To secure the DCP connection, the checker looks for the ASP.NET Core developer HTTPS certificate that is fully trusted and exportable with a private key. AddDeveloperCertificateArguments throws DcpDeveloperCertificateUnavailableException when no matching certificate exists, because DCP requires a trusted, exportable dev cert to configure TLS.","triggerScenarios":"DcpConnectionChecker.StartAsync calls AddDeveloperCertificateArguments and the X509 certificate enumeration finds no certificate that simultaneously HasPrivateKey and has CertificateManager trust level Full - e.g. `dotnet dev-certs https` never run, cert untrusted in the OS store, or non-exportable key.","commonSituations":"Fresh machines or CI containers where the dev certificate was never created/trusted, expired dev certificates that were removed, macOS keychain certs without exportable private keys, Linux machines where the cert wasn't trusted into the system store.","solutions":["Run `dotnet dev-certs https --trust` to create and trust a fresh developer certificate, then rerun the doctor check.","If a certificate exists but is untrusted, re-trust it (`dotnet dev-certs https --clean` then `--trust`).","On Linux, ensure the dev cert was exported/installed into the system CA store (dotnet dev-certs handles this on supported distros).","Verify with `dotnet dev-certs https --check --trust` that a fully trusted cert with a private key exists before running doctor."],"exampleFix":"// shell fix\n// before: doctor fails: no fully trusted exportable dev cert\ndotnet dev-certs https --clean\ndotnet dev-certs https --trust\n// then rerun: aspire doctor","handlingStrategy":"validation","validationCode":"// shell precheck before running doctor\ndotnet dev-certs https --check --trust\n// exit code 0 + 'Trusted' means a trusted dev cert exists","typeGuard":null,"tryCatchPattern":"try { await checker.CheckAsync(options); }\ncatch (DcpDeveloperCertificateUnavailableException ex) { Console.Error.WriteLine($\"Run 'dotnet dev-certs https --trust' first. ({ex.Message})\"); }","preventionTips":["Run `dotnet dev-certs https --trust` on new machines, containers, and after cert expiration.","Periodically check with `dotnet dev-certs https --check --trust`.","On Linux/macOS confirm trust steps completed for the current user session."],"tags":["dcp","certificate","https","trust","doctor"],"backgroundTag":"developer-certificate-untrusted","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}