How to force Visual Studio to re-create the SSL certificate for a .NET Core Web Application running Kestrel?

Question

When a web project is created, Visual Studio automatically generates a SSL certificate and prompts you to install it. Everything works fine.

That certificate has now expired and I cannot figure out how to get it to re-generate one and start the process over again. I've tried deleting all existing localhost certificates from the certificate store and deleting secrets.json, but nothing seems to force it to re-start the generation process.

Anette

Answer 1

I finally figured it out.

For anyone else who runs into this, the steps to fix it are:

• All localhost certificates must be deleted in certificate manager. They can be found in Personal and Trusted Root
• The secrets.json file must be deleted. This can be found in \Users\[user]\AppData\Roaming\Microsoft\UserSecrets\
• In powershell, re-run dotnet dev-certs https --trust to create and install a new one with the prompt to trust

It will work after this again.

Anette

I think you can use dotnet dev-certs https --clean in place of the first 2 steps. – Delayedaction

Thank you, I did not know that command existed. I will try it next time. – Anette

For what it's worth, I had to delete the key Kestrel:Certificates:Development:Password from UserSecrets, after using dotnet dev-certs https --clean. – Therapy

I still hade to do the two first steps manually even though I ran the --clean command. – Luciana

Thanks, this worked for me but I had to restart my system after the last step. – Jacki

A full system restart wasn't needed in my case. I just had to close any existing window of the browser where you're trying to open the web page. Apparently some of the browsers (Edge in this case) are keeping some sort of certificate cache. – Industrious

I had to close Visual Studio and Chrome to get finally certificates generated – Stumpy

"dotnet dev-certs https --clean" not always work, I had to remove secrets.json file manually, as author described. Then it worked. – Hardden

Answer 2

From Visual Studio 2022 > Tools > Nuget Package Manager > Package Manager Console

When the Package Manager Console display appears at the bottom, then type the command below

        PM > dotnet dev-certs https --clean
        //Cleaning HTTPS development certificates from the machine. A prompt might get displayed to confirm the removal of some of the certificates.
        //HTTPS development certificates successfully removed from the machine.

        PM > dotnet dev-certs https --trust
        //Trusting the HTTPS development certificate was requested.A confirmation prompt will be displayed if the certificate was not previously trusted.Click yes on the prompt to trust the certificate.
        //Successfully created and trusted a new HTTPS certificate.

        PM > dotnet dev-certs https --check
        //A valid certificate was found: C40087E6CA2F2A811F3BF78E3C5FE6BA8FA2XXXX - CN = localhost - Valid from 2023 - 01 - 27 23:21:10Z to 2024 - 01 - 27 23:21:10Z - IsHttpsDevelopmentCertificate: true - IsExportable: true
        //Run the command with both--check and --trust options to ensure that the certificate is not only valid but also trusted.

Look at here for details

Easley

I had to close all Chrome windows in order for this to finally work – Paleoasiatic

In my case, running these commands from PMC didn't work. I had to first close VS, open powershell as admin, and run the first command only. Then reopen VS, run the project and it will prompt to install a new certificate. – Talich

Answer 3

I spent days trying to solve this and none of the above answers worked for me. The expired certificate didn't exist anywhere when searching in the Microsoft Management Console. After running the dotnet dev-certs https --clean and --trust commands, the certificate used by my browsers was still expired.

The solve for me was navigating to %APPDATA%\ASP.NET\https or C:\Users\{user}\AppData\Roaming\ASP.NET\https and removing the certificates there. They should have your project name i.e. myproject.key and myproject.pem. Delete those files, then rebuild and run your project. This should automatically generate new versions of the files and the browser should pick up the new certificate.

Thanks to this post for providing the fix!

Trincomalee

Cheers! This worked for me. After attempting all other solutions (1) VS 2022 update/repair (2) delete all localhost certs in certmgr console (3) Powershell and/or Nuget console [dotnet dev-certs https -clear, dotnet dev-certs https -trust, dotnet dev-certs https -check] had no effect, expired cert getting pulled into IISExpress dev runs. – Judkins

Yes! The above answers are incomplete without mentioning this step. It seems the dotnet dev-certs https --clean command is also incomplete, without automatically taking care of this! – Grieg

This GitHub issue suggests that the problem might be caused by running in Docker-- github.com/dotnet/aspnetcore/issues/15357 – Grieg

I was not using docker at the time for my project. But the same issue could still be caused by the docker toolset. – Trincomalee

This answer worked for me (and not the others), probably because my Angular project start command includes "ng serve --ssl-cert %APPDATA%\ASP.NET\https" – Volkslied

This worked brilliantly, after many other failed approaches. Thanks! :) – Carnatic

Upvoted for still being relevant. This fixed my expired certificates as well :) – Directorial

Answer 4

Solution for Visual studio generating the same expired certificate.

This is not a direct answer to the question, but related to the problem. For me, after removing the certificate and letting Visual Studio reinstall it (I was getting prompted to install after removing certificate and restarting VS), my old expired certificate was regenerated again (!).

To resolve this you need to repair IIS, see here for more details Repair IIS. Then restart Visual Studio, start debugger and it will generate a new certificate.

Encounter