diff --git a/src/frontend/src/content/docs/app-host/certificate-configuration.mdx b/src/frontend/src/content/docs/app-host/certificate-configuration.mdx
index 89c559865..165d1326a 100644
--- a/src/frontend/src/content/docs/app-host/certificate-configuration.mdx
+++ b/src/frontend/src/content/docs/app-host/certificate-configuration.mdx
@@ -493,6 +493,22 @@ await builder.build().run();
   doesn't natively support appending certificates to the default trust store.
 </Aside>
 
+<Aside type="note" title="Linux system trust preservation">
+  On Linux, executable resources configured with Append mode preserve access
+  to the system's OpenSSL certificate roots in addition to Aspire's generated
+  development certificate. If `SSL_CERT_DIR` is set in the AppHost process
+  environment, Aspire adds those directories after its generated certificate
+  directory. An explicitly empty value is preserved by not inferring system
+  directories. If `SSL_CERT_DIR` is unset, Aspire adds any well-known system
+  certificate directories that exist on the machine (for example,
+  `/etc/ssl/certs`) after its own. Aspire reads this value from the AppHost
+  process environment, not from an individual resource's configured
+  environment. This avoids a scenario where Linux workloads launched with
+  `dotnet run` or an IDE lose OpenSSL's implicit system certificate roots and
+  fail outbound HTTPS requests once Aspire configures the resource with only
+  its generated certificate directory.
+</Aside>
+
 #### Override mode
 
 Attempts to override a resource to only trust the configured certificates, replacing the default trusted certificates entirely. This mode is useful when you need strict control over which certificates are trusted.
diff --git a/src/frontend/src/content/docs/reference/cli/commands/aspire-doctor.mdx b/src/frontend/src/content/docs/reference/cli/commands/aspire-doctor.mdx
index e98fdfbec..047f7aa33 100644
--- a/src/frontend/src/content/docs/reference/cli/commands/aspire-doctor.mdx
+++ b/src/frontend/src/content/docs/reference/cli/commands/aspire-doctor.mdx
@@ -55,6 +55,19 @@ This command is useful for troubleshooting when you encounter issues with Aspire
   for example `libnss3-tools`, to resolve the warning.
 </Aside>
 
+<Aside type="note">
+  On Linux, `aspire doctor` also checks the OpenSSL development certificate
+  cache under the dev-certs trust directory. It reports a warning when the
+  cache is missing the current HTTPS development certificate, is missing the
+  subject-hash link OpenSSL uses to look up certificates by directory, or
+  contains certificate files that can't be read (for example, because they're
+  corrupt). In each case, `aspire doctor` recommends running `aspire certs
+  clean` followed by `aspire certs trust` to remove stale or corrupt
+  certificates and regenerate trusted development certificates. If the
+  `openssl` command isn't installed, the fix suggestion also tells you to
+  install it first.
+</Aside>
+
 The command displays results with clear status indicators:
 
 - ✅ (green) - Check passed
@@ -157,6 +170,18 @@ Environment
        Install certutil from your distribution's NSS tools package (for example, libnss3-tools).
 ```
 
+On Linux, when the OpenSSL development certificate cache is stale, missing the
+current certificate, or contains unreadable certificate files, the Environment
+section reports a warning with a suggestion to clean and re-trust the
+certificate:
+
+```bash title="Aspire CLI"
+Environment
+  ✅ Operating system: Linux Ubuntu 24.04
+  ⚠️ OpenSSL HTTPS development certificate cache is missing the current certificate
+       Run 'aspire certs clean' and then 'aspire certs trust' to remove stale or corrupt certificates and regenerate trusted development certificates.
+```
+
 When only Podman is running:
 
 ```bash title="Aspire CLI"