A certificate chain links a server’s TLS certificate to a trusted root certificate. It helps a browser verify that the certificate came from the expected server, not merely observe its public key. section 28.2
A typical HTTPS trust check involves:
- The server certificate, containing the public key; the matching private key remains available only to the server. section 28.2
- Additional certificates from a certificate authority, leading through the chain to a root certificate. section 28.2
- A browser trust decision based on its built-in list of trusted root certificates. section 28.2
Trusting a development certificate
For local ASP.NET Core HTTPS development on Windows or macOS, run `dotnet dev-certs https --trust`. A trusted development certificate removes the browser warning; production applications require a certificate signed by a trusted CA instead. section 28.2
Figure 28.4 The developer certificate is not trusted by default, so apps serving HTTPS traffic using it will be marked as insecure by browsers. Although you can bypass the warnings if necessary, you should instead update the certificate to be trusted.
Use the figure to compare an untrusted development certificate with the trusted state after configuration. section 28.2
