net::ERR_CERT_AUTHORITY_INVALID in ASP.NET Core

Question

I am getting the net::ERR_CERT_AUTHORITY_INVALID error in ASP.NET Core when I try to request my Web API from an SPA.

The first solution to fix the issue was to go my ASP.NET Core address from browser Advanced - Proceed to localhost (unsafe) and after that the requests from my SPA would work. But I would have to repeat the procedure each time I am starting to work on my project.

Another solution I found was this. In a nutshell the solution is to run the command: dotnet dev-certs https --trust. I am on Windows, so according to the linked article On Windows it'll get added to the certificate store.

But after I run the command I am still getting the net::ERR_CERT_AUTHORITY_INVALID issue on requests. What could I do about it?

Answer 1

Do this in the order

1. dotnet dev-certs https --clean
2. Remove your keys and pem from AppData\Roaming\ASP.NET\https
3. dotnet dev-certs https --trust
4. Run SPA project with "start": "set HTTPS=true&&react-scripts start"

If you run your project(Point 4) before anything else. The authority is not trusted(done by 3) and results in authority invalid errors

Answer 2

Running the command dotnet dev-certs https --trust will create a self-signed certificate in your device. This certificate will be issued to the localhost domain. In my case, after running it, the certificate was created but it was not added to "Trusted Root Certification Authorities".

To add the certificate, you will need to open certmgr.msc (win+r and run certmgr.msc), then go to "Personal" certificates and export the .cer certificate issued to localhost with the correct expiration time.

If you cannot find the certificate there, you can go to the browser and click on the not secure connection icon, then open the invalid certificate and go to the Details tab and click "Copy to File...", which should create also a .cer certificate.

Next, go to "Trusted Root Certification Authorities" and import the certificate there. Once that is done, the certificate will be valid in your local machine. You may need to restart the browser and the service.

Answer 3

In my case this worked:

Clean the old certificate and generate a new trusted one. Run the commands listed below:

1. dotnet dev-certs https --clean
2. dotnet dev-certs https --trust

Go to %APPDATA%\Microsoft\UserSecrets and delete all of the directories --> this is very important

Re-run the application. It should now run with no SSL errors

source: https://joeblogs.technology/2021/11/neterr_cert_date_invalid/

Answer 4

In your application, add a reference to the Microsoft.AspNetCore.Authentication.Certificate via NuGet package. Then in the Startup.ConfigureServices method write this:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(
        CertificateAuthenticationDefaults.AuthenticationScheme)
        .AddCertificate();

    // All other service configuration
}

Also add app.UseAuthentication(); in the Startup.Configure method. Otherwise, the HttpContext.User will not be set to ClaimsPrincipal

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
   app.UseAuthentication();

    // All other app configuration
}

Source: https://learn.microsoft.com/en-us/aspnet/core/security/authentication/certauth?view=aspnetcore-3.1

Answer 5

For Ubuntu, you need some extra steps:

1. Run sudo apt-get install libnss3-tools
2. Run ls $HOME/.pki/nssdb to check if this directory exists.
3. If not, then run mkdir $HOME/.pki/nssdbto create the directory.
4. Export the certificate with dotnet dev-certs https then sudo -E dotnet dev-certs https -ep /usr/local/share/ca-certificates/aspnet/https.crt --format PEM
5. Run the commands sudo certutil -d sql:$HOME/.pki/nssdb -A -t "P,," -n localhost -i /usr/local/share/ca-certificates/aspnet/https.crt and sudo certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n localhost -i /usr/local/share/ca-certificates/aspnet/https.crt

Restart the browser.

More details in this link (for Ubuntu and other Linux distros too).

Answer 6

While we all wish that "dotnet dev-certs https --trust" did all these chores; the reality is that Microsoft's tools are not that robust. It only wasted 5 hours in my case!

A lot of clues came from various StackOverflow.com answers including that of @trixo on this very thread.

Stop IIS Express

by right clicking on its tray icon and then click on Exit

On the command prompt issue the following commands

• dotnet dev-certs https --clean
• dotnet dev-certs https --trust

Repair IIS Express

Control Panel > Programs and Features > Locate IIS Express > right click and click on "Repair"

Answer 7

I followed these steps and it didn't stop the "Not secure" message appearing in Chrome. So then I tried commenting the following line //app.UseHttpsRedirection(); in startup.cs in the Configure() method and it fixed the problem.