What causes "The provided certificate is invalid." in microsoft/aspire?

Inspect InnerException (CryptographicException) to identify the real decode failure and fix the certificate bytes or password accordingly.

microsoft/aspire · error · ArgumentException

The provided certificate is invalid.

Error message

The provided certificate is invalid.

What it means

The Certificate init accessor wraps public-key inspection in try/catch; if reading the certificate's key data throws CryptographicException, the annotation rethrows it as ArgumentException('The provided certificate is invalid.') with the original exception as InnerException. This indicates the certificate bytes could not be interpreted at all.

Solutions

Inspect InnerException (CryptographicException) to identify the real decode failure and fix the certificate bytes or password accordingly.
Validate the file locally before deployment: openssl pkcs12 -in cert.pfx -passin pass:... -nokeys and openssl x509 -in cert.pem -noout.
Re-export to a standard PFX (PKCS#12) with modern encryption (AES) and re-provision the secret.
Catch ArgumentException around annotation construction and fail startup with the inner cryptographic detail logged.

Example fix

// before
var cert = new X509Certificate2(certBytes, badPassword);
var annotation = new HttpsCertificateAnnotation { Certificate = cert }; // ArgumentException 'certificate is invalid'
// after
var cert = new X509Certificate2(certBytes, resolvedPassword);
var annotation = new HttpsCertificateAnnotation { Certificate = cert };

Defensive patterns

Strategy: try-catch

Validate before calling

// probe the cert before constructing the annotation
try { _ = new X509Certificate2(certBytes, password); }
catch (CryptographicException ce)
{
    throw new InvalidOperationException("Certificate bytes/password are invalid: " + ce.Message, ce);
}

Try / catch

try
{
    var annotation = new HttpsCertificateAnnotation { Certificate = cert };
}
catch (ArgumentException ex) when (ex.Message.Contains("certificate is invalid"))
{
    var root = ex.InnerException as CryptographicException; // log and fail with detail
}

Prevention

Validate cert files/passwords locally with openssl before provisioning.
Log InnerException (CryptographicException) to pinpoint the decode failure.
Use standard PKCS#12/AES exports and current password handling.
Confirm the secret payload is the certificate, not a CSR or public-only blob.

When it happens

Trigger: Assigning an X509Certificate2 constructed from malformed DER/PEM bytes, a password-protected PFX loaded with a wrong/missing password that surfaces later, or an unsupported key algorithm to HttpsCertificateAnnotation.Certificate.

Common situations: Secrets manager or env var containing the wrong blob (e.g. a CSR instead of a cert); CRLF/whitespace damage from templating; legacy crypto algorithm unsupported by the current platform/OpenSSL.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of microsoft/aspire@25830f84bd (2026-09-16). Data as JSON: /api/errors/8d472eb65c61b4b3. Report an issue: GitHub.

Appendix: source

Thrown at src/Aspire.Hosting/ApplicationModel/HttpsCertificateAnnotation.cs:47

            {
                throw new ArgumentException("Cannot set both UseDeveloperCertificate and Certificate properties.", nameof(value));
            }

            if (value?.HasPrivateKey == false)
            {
                throw new ArgumentException("The provided certificate must have a private key.", nameof(value));
            }

            try
            {
                if (value != null && value.PublicKey == null)
                {
                    throw new ArgumentException("The provided certificate must have a valid public key.", nameof(value));
                }
            }
            catch (CryptographicException ex)
            {
                throw new ArgumentException("The provided certificate is invalid.", nameof(value), ex);
            }

            _certificate = value;
        }
    }

    /// <summary>
    /// Gets or sets a value indicating whether the resource should use a platform developer certificate for its key pair.
    /// </summary>
    public bool? UseDeveloperCertificate
    {
        get => _useDeveloperCertificate;
        init
        {
            _useDeveloperCertificate = value;
            if (value == true && _certificate != null)
            {
                throw new ArgumentException("Cannot set both UseDeveloperCertificate and Certificate properties.", nameof(value));

View on GitHub (pinned to 25830f84bd)