What causes "The developer certificate did not have a thumbprint." in microsoft/aspire?

Clean and recreate the developer certificate: `dotnet dev-certs https --clean` then `dotnet dev-certs https --trust`.

microsoft/aspire · error · DcpDeveloperCertificateUnavailableException

The developer certificate did not have a thumbprint.

Error message

The developer certificate did not have a thumbprint.

What it means

After selecting the trusted developer certificate, DCP needs its thumbprint to pass as `--tls-cert-thumbprint`. If the selected X509Certificate2's Thumbprint is null/whitespace (the certificate lacks a thumbprint hash in the store), AddDeveloperCertificateArguments throws DcpDeveloperCertificateUnavailableException, since DCP cannot be configured for TLS without it.

Solutions

Clean and recreate the developer certificate: `dotnet dev-certs https --clean` then `dotnet dev-certs https --trust`.
Inspect the certificate store (certmgr/Keychain Access) and remove malformed duplicate dev-cert entries, then regenerate.
If a corporate/HSM crypto provider is interfering, move the dev cert to the default personal store with an exportable software key.
Rerun the doctor check after regenerating the certificate.

Example fix

// shell fix
// before: doctor fails: cert has no thumbprint
dotnet dev-certs https --clean
dotnet dev-certs https --trust
// verify thumbprint now present
dotnet dev-certs https -q --check

Defensive patterns

Strategy: validation

Validate before calling

using var cert = GetDevCertificate();
if (cert is null || string.IsNullOrWhiteSpace(cert.Thumbprint))
    Console.WriteLine("Dev certificate unusable - run 'dotnet dev-certs https --clean' then '--trust'.");

Type guard

static bool HasUsableThumbprint(X509Certificate2? c) => c is not null && !string.IsNullOrWhiteSpace(c.Thumbprint);

Try / catch

try { await checker.CheckAsync(options); }
catch (DcpDeveloperCertificateUnavailableException ex) when (ex.Message.Contains("thumbprint")) { /* regenerate dev cert and retry */ }

Prevention

Regenerate dev certs rather than debugging odd store entries; corruption is rare but regeneration is cheap.
Avoid HSM/smartcard-backed certs for the ASP.NET Core dev certificate.
Clean duplicate dev-cert entries from the personal store.

When it happens

Trigger: AddDeveloperCertificateArguments selects a certificate (has private key, full trust) whose Thumbprint property is null or empty - rare store/certificate-provider anomalies where the cert object is valid but the thumbprint string is unavailable.

Common situations: Certificates loaded from unusual stores or HSM/KSP providers that do not expose the thumbprint, corrupted certificate store entries, or platform-specific crypto provider quirks (e.g. weird smartcard-backed or CNG key entries).

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/d52c32a0caff135e. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Cli/Utils/EnvironmentChecker/DcpConnectionChecker.cs:426

        }

        private static void AddDeveloperCertificateArguments(List<string> arguments, CertificateManager certificateManager, IEnvironment environment)
        {
            var certificates = certificateManager.ListCertificates(StoreName.My, StoreLocation.CurrentUser, isValid: true);
            try
            {
                var certificate = certificates.FirstOrDefault(c =>
                    c.HasPrivateKey &&
                    certificateManager.GetTrustLevel(c) == CertificateManager.TrustLevel.Full);

                if (certificate is null)
                {
                    throw new DcpDeveloperCertificateUnavailableException(DoctorCommandStrings.DcpDeveloperCertificateNoTrustedExportableDetails);
                }

                if (string.IsNullOrWhiteSpace(certificate.Thumbprint))
                {
                    throw new DcpDeveloperCertificateUnavailableException(DoctorCommandStrings.DcpDeveloperCertificateMissingThumbprintDetails);
                }

                arguments.Add("--tls-cert-thumbprint");
                arguments.Add(certificate.Thumbprint);

                if (environment.IsWindows())
                {
                    return;
                }

                var certificatePath = DcpDeveloperCertificateCache.EnsureDeveloperCertificateCache(certificateManager, certificate);
                var keyPath = Path.ChangeExtension(certificatePath, ".key");

                arguments.Add("--tls-cert-file");
                arguments.Add(certificatePath);
                arguments.Add("--tls-key-file");
                arguments.Add(keyPath);
            }

View on GitHub (pinned to 25830f84bd)