{"record":{"id":"cacd9af4728bcb0d","repo":"microsoft/aspire","slug":"cannot-set-both-usedevelopercertificate-and-certificate","errorCode":null,"errorMessage":"Cannot set both UseDeveloperCertificate and Certificate properties.","messagePattern":"Cannot set both UseDeveloperCertificate and Certificate properties\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting/ApplicationModel/HttpsCertificateAnnotation.cs","lineNumber":30,"sourceCode":"/// </summary>\n[Experimental(\"ASPIRECERTIFICATES001\", UrlFormat = \"https://aka.ms/aspire/diagnostics/{0}\")]\npublic sealed class HttpsCertificateAnnotation : IResourceAnnotation\n{\n    private X509Certificate2? _certificate;\n    private bool? _useDeveloperCertificate;\n\n    /// <summary>\n    /// Sets an <see cref=\"X509Certificate2\"/> instance associated with this annotation.\n    /// If a certificate is provided, it must have a private key; otherwise, an <see cref=\"ArgumentException\"/> is thrown when setting the value.\n    /// </summary>\n    public X509Certificate2? Certificate\n    {\n        get => _certificate;\n        init\n        {\n            if (value != null && _useDeveloperCertificate == true)\n            {\n                throw new ArgumentException(\"Cannot set both UseDeveloperCertificate and Certificate properties.\", nameof(value));\n            }\n\n            if (value?.HasPrivateKey == false)\n            {\n                throw new ArgumentException(\"The provided certificate must have a private key.\", nameof(value));\n            }\n\n            try\n            {\n                if (value != null && value.PublicKey == null)\n                {\n                    throw new ArgumentException(\"The provided certificate must have a valid public key.\", nameof(value));\n                }\n            }\n            catch (CryptographicException ex)\n            {\n                throw new ArgumentException(\"The provided certificate is invalid.\", nameof(value), ex);\n            }","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting/ApplicationModel/HttpsCertificateAnnotation.cs#L12-L48","documentation":"HttpsCertificateAnnotation.Certificate's init accessor rejects a certificate when UseDeveloperCertificate was already set to true. The two options configure the same HTTPS certificate slot and are mutually exclusive, so the annotation throws ArgumentException naming the 'value' parameter.","triggerScenarios":"Object-initializer or constructor call that sets UseDeveloperCertificate = true and also assigns Certificate = X509Certificate2 (in either order, since the Certificate setter also runs when UseDeveloperCertificate is initialized afterwards).","commonSituations":"Copy-pasting Kestrel-style certificate config into an Aspire annotation; merging two config sources that each specify a certificate; toggling from developer cert to a real cert but leaving both properties set.","solutions":["Set only one of the two properties: remove UseDeveloperCertificate = true if supplying a real certificate.","Remove the explicit Certificate when the developer certificate is intended.","Read the current annotation state and branch so exactly one property is assigned.","Wrap annotation creation in try/catch (ArgumentException) to surface the config conflict to the user during startup validation."],"exampleFix":"// before\nvar annotation = new HttpsCertificateAnnotation\n{\n    UseDeveloperCertificate = true,\n    Certificate = new X509Certificate2(\"cert.pfx\", password)\n};\n// after\nvar annotation = new HttpsCertificateAnnotation\n{\n    Certificate = new X509Certificate2(\"cert.pfx\", password)\n};","handlingStrategy":"validation","validationCode":"// before constructing the annotation\nif (useDevCert && explicitCertificate is not null)\n    throw new ArgumentException(\"Specify either UseDeveloperCertificate or Certificate, not both.\");","typeGuard":null,"tryCatchPattern":"try\n{\n    var annotation = new HttpsCertificateAnnotation { /* one of the two only */ };\n}\ncatch (ArgumentException ex) when (ex.Message.Contains(\"UseDeveloperCertificate\"))\n{\n    // report conflicting HTTPS certificate configuration\n}","preventionTips":["Pick one certificate source (dev cert vs explicit) per environment profile.","Never merge HTTPS settings from two config sources onto the same annotation.","Centralize annotation creation in one factory that enforces the exclusivity.","Review object initializers for both properties appearing together."],"tags":["dotnet","aspire","https","certificate","configuration"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}