Enforce HTTPS: add SLES/openSUSE certificate trust instructions (#28292) - #37675
Merged
Merged
Conversation
Replaces the SLES placeholder (and the commented-out RHEL copy) with steps verified on SLES 15 SP7 and openSUSE Leap 15.6: zypper package names, certutil for Chromium/Firefox, curl --cacert, cleanup, and a note on why the system trust store does not accept the CA:FALSE dev certificate. Fixes dotnet#28292 Contributes to dotnet#27603
Contributor
Author
|
@dotnet-policy-service agree |
baylavdev
changed the title
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Address the certificate directory rehashing, NSS database initialization, Firefox trust flag, and stale ms.date issues.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (2)
What changed in this PR
Adds SLES/openSUSE certificate trust instructions to the HTTPS documentation.
Changes:
- Documents SUSE dependencies, certificate export, browser, Firefox, and OpenSSL trust setup.
- Adds cleanup steps and explains the system trust-store limitation.
- Updates metadata.
| File | Description |
|---|---|
aspnetcore/security/enforcing-ssl.md |
Adds SLES/openSUSE certificate trust guidance. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| ``` | ||
|
|
||
| ### Cleaning up the Development Certificates | ||
| Alternatively, point `SSL_CERT_DIR` at a directory that contains the certificate as described in [OpenSSL trust](#openssl-trust). |
| monikerRange: '>= aspnetcore-3.0' | ||
| ms.custom: linux-related-content | ||
| ms.date: 07/29/2026 | ||
| ms.date: 09/17/2026 |
tdykstra
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces the "see issue #28292" placeholder and the commented-out RHEL copy in
aspnetcore/security/enforcing-ssl.mdwith a real Trust the certificate on SUSE Linux Enterprise Server (SLES) and openSUSE section:mozilla-nss-toolsprovidescertutil)certutil)curl/OpenSSL clients (--cacert, orSSL_CERT_DIRvia the existing OpenSSL trust section)/etc/pki/trust/anchors/+update-ca-certificatesdoes not work (the dev cert isCA:FALSE;p11-kitlists it as an anchor but omits it from the bundles, so OpenSSL keeps rejecting it)Fixes #28292. Contributes to #27603 (SLES coverage; the RHEL/tabs restructuring in that issue is out of scope here).
Why
The page has pointed SLES users at a GitHub issue since 2023, and the commented-out block was a straight copy of the RHEL steps with
dnf, which doesn't apply. Two earlier volunteers dropped the item for lack of a SLES environment to verify on.How
registry.suse.com/bci/dotnet-sdk:8.0(SLES 15 SP7) andregistry.opensuse.org/opensuse/leap:15.6, including the negative result for the system trust store.####(nested under thelinux-dev-certssubsection by accident) to###, a sibling of the other Linux subsections.${CertificateDirectory},${UserProfile}) and the[!WARNING]/[!NOTE]alert syntax.ms.dateupdated.Checklist
#openssl-trustis an existing heading in the article)ms.dateInternal previews
Build report