Description

When automatic dev cert trust is enabled but the newest dev cert isn't in the trusted root store, Aspire now emits explicit log warnings and dashboard notifications to surface the issue. This replaces confusing per-service TLS errors with a clear actionable message pointing to https://aka.ms/aspire/devcerts.

Changes:

• DcpHost.cs: During startup, checks for HTTPS/TLS usage before probing cert trust state. Emits LogWarning and sends a dashboard notification (when available) if no trusted certs exist or the latest cert is untrusted. Log messages and dashboard messages now reference https://aka.ms/aspire/devcerts instead of dotnet dev-certs commands.
• DeveloperCertificateService: Cross-platform trust detection via X509Chain building. Exposes Certificates (trusted only) and LatestCertificateIsUntrusted to distinguish between "no trusted cert" and "newer untrusted cert present" scenarios.
• DashboardEventHandlers: Configures the dashboard Kestrel instance and the app host gRPC service with a certificate callback that uses a verified dev cert rather than the default Kestrel cert resolution.
• InteractionStrings.resx + all .xlf files: Messages updated to drop dotnet dev-certs https --trust command references in favor of See https://aka.ms/aspire/devcerts for more information.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Link to aspire.dev issue:
      • [13.2] Add a new aka.ms link and documentation on setup of developer certificates microsoft/aspire.dev#526
  • No

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.