Add initial support for custom certificate trust #11889

danegsta · 2025-10-07T22:08:01Z

Description

This PR implements custom certificate trust support (including implicit trust for the ASP.NET developer certificate). Users can override the default dev cert trust via configuration ("DcpPublisher:TrustDeveloperCertificate": false) and explicit trust per-resource can be configured via .WithDeveloperCertificateTrust(true/false).

Additionally, users can create custom certificate collections via .AddCertificateAuthorityCollection and load their own X509Certificate2 certificates into it via .WithCertificate and .WithCertificates, then assign these CertificateAuthorityCollection resources to Executables and Containers with .WithCertificateAuthorityCollection. Resources will be initialized with the union of all the CertificateAuthorityCollections that were passed to them. Additionally, you can use .WithCustomCertificateAuthoritiesScope to indicate how you want custom certificates applied to the resource. Setting the scope to the default value of CustomCertificateAuthoritiesScope.Append will indicate that you want to append any custom trusted certificates to the default certificate trust behavior for the resource. CustomCertificateAuthoritiesScope.Override indicates you want to only trust the provided certificates.

Integrations can configure how certificate trust is applied using .WithExecutableCertificateTrustCallback and .WithContainerCertificateTrustCallback, each of which take a callback that receives a context object that can be used to configure the command line arguments and environment variables required to implement trust for the given resource.

This PR is a work in progress; core functionality and support for OpenSSL based containerized resources has been implemented, but additional test coverage and support for other app integrations is still in progress.

Fixes #11679

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
- No
Does the change require an update in our Aspire docs?
- Yes
  - Link to aspire-docs issue (consider using one of the following templates):
- No

github-actions · 2025-10-07T22:08:11Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 11889

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 11889"

Copilot

Pull Request Overview

This PR implements initial support for custom certificate trust in Aspire, allowing users to configure certificate authorities for resources. The feature includes implicit trust for ASP.NET developer certificates by default, with override capabilities through configuration and explicit resource-level settings.

Key Changes

Added certificate trust framework with new resource types and annotations for managing certificate authorities
Integrated developer certificate service for automatic detection and trust of ASP.NET Core development certificates
Extended DCP executor to handle certificate trust configuration for both executable and container resources

Reviewed Changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
X509Certificate2Extensions.cs	New utility for identifying and validating ASP.NET Core development certificates
ResourceBuilderExtensions.cs	Added extension methods for configuring certificate trust on resources
IDeveloperCertificateService.cs	Service interface for accessing development certificate information
DeveloperCertificateService.cs	Implementation of certificate discovery and validation service
DcpOptions.cs	Added configuration option for developer certificate trust
DcpExecutor.cs	Core logic for applying certificate trust to executables and containers
ContainerResourceBuilderExtensions.cs	Minor refactoring to use consistent annotation behavior
Certificate annotation classes	New annotation types for managing certificate trust callbacks and collections
CertificateAuthorityCollection classes	Resource type and extensions for managing certificate collections
YarpResourceExtensions.cs	Updated to use developer certificate service for conditional configuration
Python/NodeJs extensions	Added certificate trust support for respective runtimes

src/Aspire.Hosting/Utils/X509Certificate2Extensions.cs

src/Aspire.Hosting/Dcp/DcpExecutor.cs

src/Aspire.Hosting/ApplicationModel/CertificateAuthorityCollectionAnnotation.cs

Co-authored-by: Copilot <[email protected]>

danegsta · 2025-10-10T22:33:43Z

Marking this as ready to review; there's likely some tweaks to be made to the APIs and a few additional test cases, but the core functionality is working. There's additional work to be done to implement support for this in individual resources (such as Python projects) and I need to figure out the best way to demonstrate this feature in a playground.

davidfowl · 2025-10-11T05:18:31Z

src/Aspire.Hosting/ApplicationModel/CertificateAuthorityCollectionAnnotation.cs

+/// <param name="certificateAuthorityCollections">Additional certificate authority collections to include.</param>
+/// <param name="trustDeveloperCertificates">A value indicating whether platform developer certificates should be considered trusted.</param>
+/// <param name="scope">The <see cref="CustomCertificateAuthoritiesScope"/> of the custom certificate authorities.</param>
+public sealed class CertificateAuthorityCollectionAnnotation(CertificateAuthorityCollection[]? certificateAuthorityCollections = null, bool? trustDeveloperCertificates = null, CustomCertificateAuthoritiesScope? scope = null) : IResourceAnnotation


Change this to use init only properties and get rid of the constructor. This feels like something that will grow over time.

davidfowl · 2025-10-11T05:19:11Z

src/Aspire.Hosting/ApplicationModel/CertificateAuthorityCollectionResourceExtensions.cs

+    /// <param name="builder">The <see cref="IResourceBuilder{CertificateAuthorityCollection}"/>.</param>
+    /// <param name="filePath">The path to the PEM file.</param>
+    /// <returns>The updated <see cref="IResourceBuilder{CertificateAuthorityCollection}"/>.</returns>
+    public static IResourceBuilder<CertificateAuthorityCollection> WithCertificatesFromFile(this IResourceBuilder<CertificateAuthorityCollection> builder, string filePath)


pemFilePath?

davidfowl · 2025-10-11T05:22:10Z

src/Aspire.Hosting/Dcp/DcpExecutor.cs

+    /// <param name="resourceEnvironment">The existing list of executable environment variables.</param>
+    /// <param name="cancellationToken">A <see cref="CancellationToken"/> that can be used to cancel the operation.</param>
+    /// <returns>A tuple containing additional command line arguments and environment variables, as well as a boolean indicating whether the operation was successful.</returns>
+    private async Task<(List<string>, List<EnvVar>, bool)> BuildExecutableCertificateAuthorityTrustAsync(IResource modelResource, List<string> resourceArguments, List<EnvVar> resourceEnvironment, CancellationToken cancellationToken)


Any reason to do this at the DCP level rather than the apphost level? Do we care about users being able to observe manipulate these or observe these as container files/env vars/args?

davidfowl · 2025-10-11T05:22:51Z

src/Aspire.Hosting/Dcp/DcpOptions.cs

+    /// Whether to attempt to implicitly add trust for developer certificates (currently the ASP.NET developer certificate)
+    /// by default.
+    /// </summary>
+    public bool TrustDeveloperCertificate { get; set; } = true;


Should this go to the DistributedApplicationOptions instead?

davidfowl · 2025-10-11T05:23:24Z

src/Aspire.Hosting/DeveloperCertificateService.cs

+
+    public DeveloperCertificateService()
+    {
+        _certificates = new Lazy<ImmutableList<X509Certificate2>>(() =>


Make sure this does not throw. Also should this log anything?

davidfowl · 2025-10-11T05:26:36Z

src/Aspire.Hosting/Dcp/DcpExecutor.cs

+            Directory.CreateDirectory(Path.Join(_locations.DcpSessionDir, modelResource.Name));
+            File.WriteAllText(caBundlePath, caBundleBuilder.ToString());


Hmm, unsure if this should be in the dcp session dir. Where do we store other temp files (we really need a single place..._

Add initial support for custom certificate trust

4b73479

Copilot AI review requested due to automatic review settings October 7, 2025 22:08

github-actions bot added the area-app-model Issues pertaining to the APIs in Aspire.Hosting, e.g. DistributedApplication label Oct 7, 2025

danegsta marked this pull request as draft October 7, 2025 22:08

Copilot AI reviewed Oct 7, 2025

View reviewed changes

danegsta and others added 7 commits October 7, 2025 15:11

Update src/Aspire.Hosting/Dcp/DcpExecutor.cs

efe6a96

Co-authored-by: Copilot <[email protected]>

Update src/Aspire.Hosting/Dcp/DcpExecutor.cs

a42e923

Co-authored-by: Copilot <[email protected]>

Update src/Aspire.Hosting/Utils/X509Certificate2Extensions.cs

0886e9e

Co-authored-by: Copilot <[email protected]>

Fix failing DCP tests

88c2eed

Merge remote-tracking branch 'upstream/main' into danegsta/trustCerts

92467b2

Fix tests that don't expect custom certificates in output

c6a94a2

Set as string

4ab71a5

davidfowl requested a review from DamianEdwards October 9, 2025 04:50

danegsta added 7 commits October 9, 2025 11:03

Skip automatic config on conflict with manual config

987b977

Update yarp tests

aa61232

Fix another failing test after change

91c924e

Add test cases for default container cert behavior

5a07be9

Use a list

757c69a

Fix last failing test

51f2648

Add examples to new API and additional helper method

8a1651e

danegsta marked this pull request as ready for review October 10, 2025 22:30

danegsta requested a review from mitchdenny as a code owner October 10, 2025 22:30

davidfowl reviewed Oct 11, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add initial support for custom certificate trust #11889

Add initial support for custom certificate trust #11889

Uh oh!

danegsta commented Oct 7, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

danegsta commented Oct 10, 2025

Uh oh!

davidfowl Oct 11, 2025

Uh oh!

davidfowl Oct 11, 2025

Uh oh!

davidfowl Oct 11, 2025

Uh oh!

davidfowl Oct 11, 2025

Uh oh!

davidfowl Oct 11, 2025

Uh oh!

davidfowl Oct 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		Directory.CreateDirectory(Path.Join(_locations.DcpSessionDir, modelResource.Name));
		File.WriteAllText(caBundlePath, caBundleBuilder.ToString());

Add initial support for custom certificate trust #11889

Are you sure you want to change the base?

Add initial support for custom certificate trust #11889

Uh oh!

Conversation

danegsta commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

github-actions bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

danegsta commented Oct 10, 2025

Uh oh!

davidfowl Oct 11, 2025

Choose a reason for hiding this comment

Uh oh!

davidfowl Oct 11, 2025

Choose a reason for hiding this comment

Uh oh!

davidfowl Oct 11, 2025

Choose a reason for hiding this comment

Uh oh!

davidfowl Oct 11, 2025

Choose a reason for hiding this comment

Uh oh!

davidfowl Oct 11, 2025

Choose a reason for hiding this comment

Uh oh!

davidfowl Oct 11, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

danegsta commented Oct 7, 2025 •

edited

Loading

github-actions bot commented Oct 7, 2025 •

edited

Loading