{"record":{"id":"d52c32a0caff135e","repo":"microsoft/aspire","slug":"the-developer-certificate-did-not-have-a-thumbprint","errorCode":null,"errorMessage":"The developer certificate did not have a thumbprint.","messagePattern":"The developer certificate did not have a thumbprint\\.","errorType":"exception","errorClass":"DcpDeveloperCertificateUnavailableException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Cli/Utils/EnvironmentChecker/DcpConnectionChecker.cs","lineNumber":426,"sourceCode":"        }\n\n        private static void AddDeveloperCertificateArguments(List<string> arguments, CertificateManager certificateManager, IEnvironment environment)\n        {\n            var certificates = certificateManager.ListCertificates(StoreName.My, StoreLocation.CurrentUser, isValid: true);\n            try\n            {\n                var certificate = certificates.FirstOrDefault(c =>\n                    c.HasPrivateKey &&\n                    certificateManager.GetTrustLevel(c) == CertificateManager.TrustLevel.Full);\n\n                if (certificate is null)\n                {\n                    throw new DcpDeveloperCertificateUnavailableException(DoctorCommandStrings.DcpDeveloperCertificateNoTrustedExportableDetails);\n                }\n\n                if (string.IsNullOrWhiteSpace(certificate.Thumbprint))\n                {\n                    throw new DcpDeveloperCertificateUnavailableException(DoctorCommandStrings.DcpDeveloperCertificateMissingThumbprintDetails);\n                }\n\n                arguments.Add(\"--tls-cert-thumbprint\");\n                arguments.Add(certificate.Thumbprint);\n\n                if (environment.IsWindows())\n                {\n                    return;\n                }\n\n                var certificatePath = DcpDeveloperCertificateCache.EnsureDeveloperCertificateCache(certificateManager, certificate);\n                var keyPath = Path.ChangeExtension(certificatePath, \".key\");\n\n                arguments.Add(\"--tls-cert-file\");\n                arguments.Add(certificatePath);\n                arguments.Add(\"--tls-key-file\");\n                arguments.Add(keyPath);\n            }","sourceCodeStart":408,"sourceCodeEnd":444,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Cli/Utils/EnvironmentChecker/DcpConnectionChecker.cs#L408-L444","documentation":"After selecting the trusted developer certificate, DCP needs its thumbprint to pass as `--tls-cert-thumbprint`. If the selected X509Certificate2's Thumbprint is null/whitespace (the certificate lacks a thumbprint hash in the store), AddDeveloperCertificateArguments throws DcpDeveloperCertificateUnavailableException, since DCP cannot be configured for TLS without it.","triggerScenarios":"AddDeveloperCertificateArguments selects a certificate (has private key, full trust) whose Thumbprint property is null or empty - rare store/certificate-provider anomalies where the cert object is valid but the thumbprint string is unavailable.","commonSituations":"Certificates loaded from unusual stores or HSM/KSP providers that do not expose the thumbprint, corrupted certificate store entries, or platform-specific crypto provider quirks (e.g. weird smartcard-backed or CNG key entries).","solutions":["Clean and recreate the developer certificate: `dotnet dev-certs https --clean` then `dotnet dev-certs https --trust`.","Inspect the certificate store (certmgr/Keychain Access) and remove malformed duplicate dev-cert entries, then regenerate.","If a corporate/HSM crypto provider is interfering, move the dev cert to the default personal store with an exportable software key.","Rerun the doctor check after regenerating the certificate."],"exampleFix":"// shell fix\n// before: doctor fails: cert has no thumbprint\ndotnet dev-certs https --clean\ndotnet dev-certs https --trust\n// verify thumbprint now present\ndotnet dev-certs https -q --check","handlingStrategy":"validation","validationCode":"using var cert = GetDevCertificate();\nif (cert is null || string.IsNullOrWhiteSpace(cert.Thumbprint))\n    Console.WriteLine(\"Dev certificate unusable - run 'dotnet dev-certs https --clean' then '--trust'.\");","typeGuard":"static bool HasUsableThumbprint(X509Certificate2? c) => c is not null && !string.IsNullOrWhiteSpace(c.Thumbprint);","tryCatchPattern":"try { await checker.CheckAsync(options); }\ncatch (DcpDeveloperCertificateUnavailableException ex) when (ex.Message.Contains(\"thumbprint\")) { /* regenerate dev cert and retry */ }","preventionTips":["Regenerate dev certs rather than debugging odd store entries; corruption is rare but regeneration is cheap.","Avoid HSM/smartcard-backed certs for the ASP.NET Core dev certificate.","Clean duplicate dev-cert entries from the personal store."],"tags":["dcp","certificate","thumbprint","doctor"],"backgroundTag":"developer-certificate-untrusted","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}