A development certificate makes it easier to test HTTPS endpoints locally. HTTPS protects requests and responses from being read or changed in transit. A publicly exposed service needs a certificate from a trusted authority; the development certificate addresses the different problem of local testing. section 3.1 section 9.3
Use the .NET CLI to manage trust on the machine running the service:
- Run `dotnet dev-certs https --check` to check whether the development certificate is trusted. section 3.1
- Run `dotnet dev-certs https --trust` to trust it on a development machine or CI/CD build agent. An IDE may already have set it up. section 3.1
Listing 3.2 Output from running the empty web service
> dotnet run
Building...
info: Microsoft.Hosting.Lifetime[14]
Now listening on: https://localhost:7041 #1
info: Microsoft.Hosting.Lifetime[14]
Now listening on: http://localhost:5292 #2
info: Microsoft.Hosting.Lifetime[0]
Application started. Press Ctrl+C to shut down.
The service startup output shows separate HTTPS and HTTP localhost addresses. Use the HTTPS address when testing a secure endpoint. section 3.1
Certificate trust is distinct from redirecting traffic to HTTPS. In ASP.NET Core, `app.UseHttpsRedirection()` redirects an HTTP request to the HTTPS URL; a development certificate supports testing that HTTPS destination. section 3.1 section 9.3
