.NET 6 preview 6.0.100-rc.1.21416.1 DevCerts Requiring Escalated Privileges With Every New WebApp

[khalidabuhakmeh]

Running the SDK version 6.0.100-rc.1.21416.1 I notice that each ASP.NET Core application requires administrative escalation privileges.

I've run the following commands to try and fix it, but it continues even after wards.

> dotnet dev-certs https --clean
> dotnet dev-certs https
> dotnet dev-certs https --trust

When I Deny the request to escalate permissions, I get these warnings.

warn: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[5]
      The ASP.NET Core developer certificate is in an invalid state. To fix this issue, run the following commands 'dotnet dev-certs https --clean' and 'dotnet dev-certs https' to remove all existing ASP.NET Core development certificates and create a new untrusted developer certificate. On macOS or Windows, use 'dotnet dev-certs https --trust' to trust the new certificate.
fail: Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer[4]
      The ASP.NET Core developer certificate is in an invalid state. To fix this issue, run the following commands 'dotnet dev-certs https --clean' and 'dotnet dev-certs https' to remove all existing ASP.NET Core development certificates and create a new untrusted developer certificate. On macOS or Windows, use 'dotnet dev-certs https --trust' to trust the new certificate.

The instructions are the same as what I've attempted previously.

Workaround

If I give the application access to the certs then it works, but I have to do this for every new web application.

[davidfowl]

cc @javiercn

[richlander]

Which macOS build are you using?

[javiercn]

It requires access to the keychain, if you are using dotnet you can click allow always and it will stop prompting.

[javiercn]

If you are running through the host (which is unsigned) it's going to ask you for every app

[richlander]

For clarity, are you saying (for this use case):

• Good: dotnet run
• Good: dotnet myapp.dll
• Less good: ./myapp

[javiercn]

Yep, provided that you are running with a notarized version of the SDK and that you hit the "allow always" stuff when prompted for access to the keychain.

[javiercn]

We switched to installing the certificate using the native Mac OS tools to avoid all the issues with notarization, so we are bound by the same rules as other apps.

[richlander]

That makes sense, both the behavior and the approach.

@khalidabuhakmeh -- welcome to the new world of doing development on macOS. We have working closely with Apple on our approach to notarization and are following their patterns.

[khalidabuhakmeh]

Hi everyone. Let me clarify a few questions that were asked:

1. I'm on macOS Big Sur

2. you can click allow always and it will stop prompting

Yes, I've clicked always allow, but this is for every new application process. So as a DevRel person, I end up creating many new projects, meaning I have to allow a lot.

If you are running through the host (which is unsigned) it's going to ask you for every app

Yep!

3. provided that you are running with a notarized version of the SDK

Are the nightly builds not notarized?

[javiercn]

I believe they are not (or not all of them)

[richlander]

I believe that nightly builds DO NOT go through any of our signing process (notarization or otherwise). That's probably it. This is a problem for me as well. We could consider signing nightly builds with a .NET Foundation (as opposed to MS) cert if this becomes a challenge. We may arrive at that point.

Microsoft policy requires us is to sign release/supported builds only. It is super easy for non-release builds to be used in scenarios where they should not and be used in ways they should not. MS signing certs are trusted on Windows, which is meaningful.

[javiercn]

@richlander whatever cert you use, it will have to be trusted for the OS to be ok with it, so it's kind-off the same situation.

[richlander]

You are right that the code would be trusted. The key thing we want to avoid is someone seeing "Microsoft Corporation" in a UAC prompt and making a choice based on the publisher. If we were to sign nightly builds, we'd want the UAC prompt to make clear that the code shouldn't be trusted.

Also, we could decide not to sign everything but do the minimum to provide better notarization UX on macOS.