Dockertools: Adding the certificate to the Trusted Root Certificate store failed with the following error: Failed with a critical error.

[xcheng75]

Visual Studio 2017 15.8.2
Asp.net core web api project, after configured https, using Docker debug, got: "Adding the certificate to the Trusted Root Certificate store failed with the following error: Failed with a critical error"

Docker version: 18.06.1-ce
Visual Studio 2017 Ran as Administrator

[bwateratmsft]

Hey @xcheng75, this looks similar to a bug we found (and have fixed for VS 15.9 Preview 3, when it releases). Does the full path to your project file contain a space?

[xcheng75]

Thanks for your reply! @bwateratmsft
The full path to my project file does not contain a space.

[xcheng75]

Do we have any work around for this above issue? i have tried to manually add the certificate into my root trusted certificate store, but the certificate seems missing something, after i opened the certificate i can see it says "Windows does not have enough information to verify this certificate." After refreshed the browser, the https url is still not taking the certificate.

Where can i find the file with the list of actions the docker tool integrated visual studio actually carries out when i initiate docker/docker-compose debugging tool from Visual studio 2017?

@bwateratmsft

[bwateratmsft]

Hey @xcheng75, let's try removing the development certificate so it gets recreated.

1. Open mmc, add the Certificate Manager for user (not machine/computer).
2. Go to Personal > Certificates
3. Look for a certificate issued to "localhost", friendly name like "ASP.NET Core HTTPS development certificate"
4. Delete that certificate
5. Relaunch Visual Studio and try again

[xcheng75]

@bwateratmsft

The docker-compose generates a unique ip address each time i initiate docker-compose debugging tool. i do not have any certificate with friendly name like "ASP.NET Core HTTPS development certificate" in certlm.

[bwateratmsft]

@xcheng75 that's correct, however, to use HTTPS some certificate must be used, so the dotnet build tools (dotnet dev-certs in particular) creates a self-signed certificate issued to localhost, installs to the user certificate store so it is trusted, and uses that for SSL. Unfortunately, because the IP address won't match "localhost", it will still present a subject name mismatch warning in the browser, but we are fixing that issue in the next version of Visual Studio.

[haniamr]

@xcheng75 did restarting VS help? If not, please execute the following commands (that's what VS is doing to trust/export the certificate into the container) and share with us the output:

1. dotnet dev-certs https --trust --check
2. echo Trust check: %errorlevel%
3. dotnet dev-certs https --trust -ep "%APPDATA%\ASP.NET\https\TestCert.pfx" -p TestPassword
4. echo Trust/Export: %errorlevel%

If all the commands succeed, are you able to find TestCert.pfx in that location %APPDATA%\ASP.NET\https\?

[xcheng75]

Yes, i can see TestCert.pfx in %APPDATA%\ASP.NET\https\ but visual studio 2017 still gives the same error and could not launch https url attaching debug to it, the docker host machine is a VM inside of Mac.... i am on my company internal network....

[xcheng75]

There is no certificate with friendly name of "ASP.NET Core HTTPS development certificate" in my certlm.

[haniamr]

@xcheng75 thanks for getting back on this, I've recently re-opened an old issue with the same description so will close this one as duplicate and track this here instead.

Please take a look at my latest comment there, I'd be happy to schedule a Skype call if you're still facing the issue.

Thanks!

[cchristodoulou]

@xcheng75 did restarting VS help? If not, please execute the following commands (that's what VS is doing to trust/export the certificate into the container) and share with us the output:

1. dotnet dev-certs https --trust --check
2. echo Trust check: %errorlevel%
3. dotnet dev-certs https --trust -ep "%APPDATA%\ASP.NET\https\TestCert.pfx" -p TestPassword
4. echo Trust/Export: %errorlevel%

If all the commands succeed, are you able to find TestCert.pfx in that location %APPDATA%\ASP.NET\https?

Thank you, that worked!