Root certificate

As explained in ASP.NET Core in Action, 3e

A root certificate is a trust-anchor certificate issued by or representing a certificate authority at the top of a certificate chain.

A root certificate sits at the end of a TLS certificate chain and represents a trusted certificate authority (CA). Browsers trust selected root certificates, allowing them to recognize an HTTPS certificate as trusted. section 28.2

ASP.NET Core development and self-signed certificates lack a root certificate trusted by browsers, so local HTTPS sites show warnings until the certificate is explicitly trusted. Production sites instead need certificates signed by a trusted CA. section 28.2

Trusting the development certificate

On Windows or macOS, run `dotnet dev-certs https --trust` to register the development certificate as trusted and remove browser warnings. section 28.2

Figure 28.4 The developer certificate is not trusted by default, so apps serving HTTPS traffic using it will be marked as insecure by browsers. Although you can bypass the warnings if necessary, you should instead update the certificate to be trusted.

Use the figures to compare browser warnings before and after trusting a development certificate. section 28.2

How ASP.NET Core in Action, 3e covers it

How deep it goes

Defines certificate-chain trust, distinguishes development from production certificates, and gives a trust command without detailing certificate internals.

Examples

Uses ASP.NET Core development certificates, browser warnings, and `dotnet dev-certs https --trust`.

What it assumes

Assumes basic public-key and private-key roles, then explains certificate chains and browser trust.

What you can do after

Operate local HTTPS by trusting an ASP.NET Core development certificate and recognize why production requires a CA-signed certificate.

How it connects

Connects root certificates with certificate authorities, TLS certificates, HTTPS, self-signed certificates, and browser trust.

liveBookmanning.com

Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersA root certificate authority is a self-signed certificate authority whose trust anchor is typically preinstalled in an operating system or other trust store.
• 

  liveBookmanning.com
  Google Anthos in ActionA root certificate is a self-signed certificate that anchors a certificate authority trust chain.

Compare how 3 books explain root certificate →

Related concepts

• certification authoritykind of · A certification authority is a trusted entity that verifies identities and issues digitally signed certificates binding public keys to identities or domains.
• certificatekind of · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
• certificate chainpart of · A certificate chain is an ordered sequence of digital certificates linking an end-entity certificate through intermediate authorities to a trusted root certificate.
• OpenSSLproduced by · OpenSSL is an open-source software library and toolkit implementing cryptographic algorithms, secure-communication protocols, and operations involving keys and certificates.
• trust storeused by · A trust store is a repository of certificates or public keys that a system accepts as trusted when validating identities or secure communications.

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.