Repository: dotnet/aspnetcore
File: src/Shared/CertificateGeneration/UnixCertificateManager.cs (C#)

Code before:
                    // SSL_CERT_DIR is set but doesn't include our directory - suggest appending
                    Log.UnixSuggestAppendingToEnvironmentVariable(prettyCertDir, OpenSslCertificateDirectoryVariableName);
                    hasValidSslCertDir = false;
                }
            }
            else if (TryGetOpenSslDirectory(out var openSslDir))
            {
                Log.UnixSuggestSettingEnvironmentVariable(prettyCertDir, Path.Combine(openSslDir, "certs"), OpenSslCertificateDirectoryVariableName);
                hasValidSslCertDir = false;
            }
            else
            {
                Log.UnixSuggestSettingEnvironmentVariableWithoutExample(prettyCertDir, OpenSslCertificateDirectoryVariableName);
                hasValidSslCertDir = false;
            }

            sawTrustFailure = !hasValidSslCertDir;
        }

        return sawTrustFailure
            ? TrustLevel.Partial
            : TrustLevel.Full;
    }

    protected override void RemoveCertificateFromTrustedRoots(X509Certificate2 certificate)
    {
        var sawUntrustFailure = false;

        using var store = new X509Store(StoreName.Root, StoreLocation.CurrentUser);
        store.Open(OpenFlags.ReadWrite);

        if (TryFindCertificateInStore(store, certificate, out var matching))
        {
            try
            {
                store.Remove(matching);
            }
            catch (Exception ex)
            {
                Log.UnixDotnetUntrustException(ex.Message);
                sawUntrustFailure = true;
            }
        }

        var homeDirectory = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile)!;

        // We don't attempt to remove the directory when it's empty - it's a standard location
        // and will almost certainly be used in the future.
        var certDir = GetOpenSslCertificateDirectory(homeDirectory); // May not exist

        var nickname = GetCertificateNickname(certificate);

Review comment (bug):
Do we care if the other linux checks run? Should this check if `sawTrustFailure` is already `true`?

Code after:
                    Log.UnixOpenSslCertificateDirectoryAlreadyConfigured(prettyCertDir, OpenSslCertificateDirectoryVariableName);
                    hasValidSslCertDir = true;
                }
                else
                {
                    // SSL_CERT_DIR is set but doesn't include our directory - suggest appending
                    Log.UnixSuggestAppendingToEnvironmentVariable(prettyCertDir, OpenSslCertificateDirectoryVariableName);
                    hasValidSslCertDir = false;
                }
            }
            else if (TryGetOpenSslDirectory(out var openSslDir))
            {
                Log.UnixSuggestSettingEnvironmentVariable(prettyCertDir, Path.Combine(openSslDir, "certs"), OpenSslCertificateDirectoryVariableName);
                hasValidSslCertDir = false;
            }
            else
            {
                Log.UnixSuggestSettingEnvironmentVariableWithoutExample(prettyCertDir, OpenSslCertificateDirectoryVariableName);
                hasValidSslCertDir = false;
            }

            sawTrustFailure = !hasValidSslCertDir;
        }

        // Check to see if we're running in WSL; if so, use powershell.exe to add the certificate to the Windows trust store as well
        if (IsRunningOnWslWithInterop())
        {
            try
            {
                if (TrustCertificateInWindowsStore(certificate))
                {
                    Log.WslWindowsTrustSucceeded();
                }
                else
                {
                    Log.WslWindowsTrustFailed();
                    sawTrustFailure = true;
                }
            }
            catch (Exception ex)
            {
                Log.WslWindowsTrustException(ex.Message);
                sawTrustFailure = true;
            }
        }

        return sawTrustFailure
            ? TrustLevel.Partial
            : TrustLevel.Full;
    }