Certificate problem starting Kestrel ASP.NET server - Windows 10, C#, VS2019

Question

My ASP.NET server was running fine on Friday. Today (Monday) I can't even start it. Error is:

crit: Microsoft.AspNetCore.Server.Kestrel[0]
      Unable to start Kestrel.
System.InvalidOperationException: Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date.
To generate a developer certificate run 'dotnet dev-certs https'. To trust the certificate (Windows and macOS only) run 'dotnet dev-certs https --trust'.
For more information on configuring HTTPS see https://go.microsoft.com/fwlink/?linkid=848054.
   at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.UseHttps(ListenOptions listenOptions, Action`1 configureOptions)
   at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.UseHttps(ListenOptions listenOptions)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IServerAddressesFeature addresses, KestrelServerOptions serverOptions, ILogger logger, Func`2 createBinding)
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken)

I have tried dotnet dev-certs https --trust many times to no avail. Each time it gives me the prompt to trust the certificate, each time with a different thumbprint.

... but nothing changes, the server still fails with the same error message. dotnet dev-certs https --check just says No valid certificate found. I have tried dotnet dev-certs https --clean which claims to succeed (but does not display any prompts), then dotnet dev-certs https --trust but still the same error when I start the server.

I have tried looking in the certificate manager in control panel (certmgr.msc) because doing so seemed to help someone else (on a different site) to solve the same error, but I have to admit I am none the wiser for having looked. Here's what shows up under Personal:

I have discovered that the server runs fine through IIS, running using the IIS profile from Visual Studio 2019. Ok, I could go adapt the client code to talk to a different TCP port, OR learn how to change the IIS server port (launchSettings.json right?).. but I would rather understand what has actually broken here, and learn how to fix it properly.

In case it helps, my Startup.Configure() says:

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            // for options and correct order, see https://docs.microsoft.com/en-us/aspnet/core/fundamentals/middleware/?view=aspnetcore-3.1

            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Error");
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseRouting();
            app.UseAuthorization();

            // app.UseAuthentication();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
                endpoints.MapRazorPages();
            });
        }

So:

How do I get a dev certificate into the default certificate location (wherever that is??) in a way that actually works? <-- my preferred fast solution today :/
Or, how do I create a dev certificate myself, and how do I tell my server where to find it?
Or, how do I make a real certificate (from my organisation's "official" certificate??) and then how do I use that to get client and server to actually check it, for good security? <-- my goal eventually, but I don't currently know enough yet to be able to do this - currently, my security comes from running client and server on a separate network.

user_15969427 · Answer

Here's what finally worked for me.

The problem was that although the Certificate Manager was not showing any expired ASP.NET certificates, the Certificate Manager was only looking at the local machine store, not the user store.

I went to the Management Console (mmc from command line) and added a Snap-in for Certificates, for current user.

When I then ran that, I found a whole bunch of ASP.NET certificates under Personal / Certificates AND Trusted Root Certification Authorities / Certificates, some of them expired. I deleted all of them.

I then ran dotnet dev-certs https --trust again, and then my server started. Yay!

user_6687586 · Answer

You need to delete all certificates issued for localhost, best way how to do it is with this Powershell script:

Get-ChildItem -Path Cert:\CurrentUser -Recurse `
| Where { $_.PSISContainer -eq $false } `
| Where { $_.Issuer -match 'localhost' } `
| Remove-Item;

 Get-ChildItem -Path Cert:\LocalMachine -Recurse `
| Where { $_.PSISContainer -eq $false } `
| Where { $_.Issuer -match 'localhost' } `
| Remove-Item

After that you will be sure that all certificates issued for localhost are gone.

Then run

dotnet dev-certs https

That's it!

Certificate problem starting Kestrel ASP.NET server - Windows 10, C#, VS2019

2 Answers