A certification authority (CA) is a trusted entity that issues or signs digital certificates. In HTTPS, the CA helps a browser verify that a certificate belongs to the server it contacted. Certificates form a chain that ends at a root certificate trusted by the browser. section 28.2
A CA supports HTTPS trust in several connected ways:
- Signs certificates so browsers can connect a server identity with a trusted root certificate. section 28.2
- Participates in production certificate issuance, where the applicant proves ownership of the domain. section 28.3
- Supports ongoing trust decisions because browsers update their root-certificate lists and revoke roots that are no longer trusted. section 28.2
Development and production certificates
An ASP.NET Core development certificate may work for HTTPS while still producing a browser warning because it is not trusted by default. A production certificate must be obtained through a trust process involving a third-party CA and proof of domain ownership, then configured for Kestrel. section 28.2 section 28.3
Figure 28.4 The developer certificate is not trusted by default, so apps serving HTTPS traffic using it will be marked as insecure by browsers. Although you can bypass the warnings if necessary, you should instead update the certificate to be trusted.
Use the figure to recognize how an untrusted development certificate appears to a browser. section 28.2
