How to Install dotnet dev-certs certificate on a CI Server

[RehanSaeed]

Describe the bug

I would like to run my API using dotnet run, so I can run some tests against it on my CI server. However, on Azure Pipelines and AppVeyor, they don't have a developer certificate installed and I get an error when I try to start my API. Installing a developer certificate involes running:

dotnet dev-certs https --trust

However, this shows a dialogue which the user has to click and this fails the build. How can I install the developer certificate on a CI server?

My scenario is that I want to run functional tests against my dotnet new project templates by actually running them. Here is an example of my unit test:

public async Task Run_HealthCheckFalse_Successful()
{
    using (var tempDirectory = TemplateAssert.GetTempDirectory())
    {
        var project = await tempDirectory.DotnetNew(
            "api",
            "HealthCheckFalse",
            new Dictionary<string, string>() { { "health-check", "false" } });
        await project.DotnetRestore();
        await project.DotnetBuild();
        await project.DotnetRun(
            @"Source\HealthCheckFalse",
            async httpClient =>
            {
                var statusResponse = await httpClient.GetAsync("status");
                Assert.Equal(HttpStatusCode.NotFound, statusResponse.StatusCode);
            });
    }
}

Expected behavior

I should be able to install the dev certificate without UI. I expected the --quiet flag to do this but that was not the case.

Screenshots

This is the dialog that appears on Windows:

[blowdart]

The dialog is a Windows limitation. We cannot provide any way to do this without a dialog. You will need to run it once manually on your CI server.

(Even if we could we could not, because it's a major security decision)

[RehanSaeed]

Apparently, if the store location is LocalMachine, the dialogue does not show up.

I guess I can try getting hold of the certificate and installing it manually myself to the LocalMachine store.

[blowdart]

I think you mean LocalUser.

You could also just export it to a PFX change your startup in a CI environment to load the cert manually and pass it to kestrel, but you'd still have to trust it, unless you do that manually and your CI server doesn't get rebuilt.

[RehanSaeed]

dev-certs seems to install to CurrentUser which shows the dialogue. The forum post says LocalMachine doesn't show the dialogue. Seems strange to me. Could a --cert-store LocalMachine option be added to the dev-certs tool?

Do I need to change the Startup? Can I get away with taking the pfx on my machine and just installing it on the CI server? I'm guessing there is some security reason that Kestrel does not use any old self signed certificate.

[blowdart]

Local Machine would, I believe, prompt a dialog too. As I said earlier we wouldn't ever provide a non-prompting version

And yes, you can export the certificate from a dev machine and install it into the stores on the CI machine, then also trust it and away you go. Or just run the dev-certs command on the CI machine itself interactively and confirm the trust dialog

[RehanSaeed]

Useful info here:

https://stackoverflow.com/questions/57221762/how-to-install-dotnet-dev-certs-certificate-on-a-ci-server/57274470