Today when I tried to debug a .NET Core application, I got a browser warning that my localhost certificate was no longer valid.
The good news is that renewing your localhost certficate when using Kestrel is easy. You can use the built-in dotnet dev-certs command to manage a self-signed certificate.
We can first remove the existing outdated certificate by executing the following command:
dotnet dev-certs https --clean
Output:
Cleaning HTTPS development certificates from the machine. A prompt might get displayed to confirm the removal of some of the certificates.
HTTPS development certificates successfully removed from the machine.
Now we can generate a new self-signed certificate using following command:
dotnet dev-certs https –trust
Output:
Trusting the HTTPS development certificate was requested. A confirmation prompt will be displayed if the certificate was not previously trusted. Click yes on the prompt to trust the certificate.
Successfully created and trusted a new HTTPS certificate.
As a last step, you can validate the certificate by executing the following command
dotnet dev-certs https –check
Output:
A valid certificate was found: 189E61FFAD59C21110E9AD13A009B984EE5E8D5D - CN=localhost - Valid from 2024-04-22 13:11:50Z to 2025-04-22 13:11:50Z - IsHttpsDevelopmentCertificate: true - IsExportable: true
Run the command with both --check and --trust options to ensure that the certificate is not only valid but also trusted.
Remark: The steps above only work when you are running your ASP.NET Core application using Kestrel, if you are using IIS or IIS Express a different approach is needed.