Repository: dotnet/aspnetcore
File: src/Shared/CertificateGeneration/CertificateManager.cs (C#)

Code before:
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.Diagnostics.Tracing;
using System.Formats.Asn1;
using System.Linq;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;
using System.Text.Json.Serialization;

#nullable enable

namespace Microsoft.AspNetCore.Certificates.Generation;

internal abstract class CertificateManager
{
    internal const int CurrentAspNetCoreCertificateVersion = 5;
    internal const int CurrentMinimumAspNetCoreCertificateVersion = 5;

    // OID used for HTTPS certs
    internal const string AspNetHttpsOid = "1.3.6.1.4.1.311.84.1.1";
    internal const string AspNetHttpsOidFriendlyName = "ASP.NET Core HTTPS development certificate";

    private const string ServerAuthenticationEnhancedKeyUsageOid = "1.3.6.1.5.5.7.3.1";
    private const string ServerAuthenticationEnhancedKeyUsageOidFriendlyName = "Server Authentication";

    // dns names of the host from a container
    private const string LocalhostDockerHttpsDnsName = "host.docker.internal";
    private const string ContainersDockerHttpsDnsName = "host.containers.internal";

    // wildcard DNS names
    private const string LocalhostWildcardHttpsDnsName = "*.dev.localhost";
    private const string InternalWildcardHttpsDnsName = "*.dev.internal";

    // main cert subject
    private const string LocalhostHttpsDnsName = "localhost";
    internal const string LocalhostHttpsDistinguishedName = "CN=" + LocalhostHttpsDnsName;

    public const int RSAMinimumKeySizeInBits = 2048;

    public static CertificateManager Instance { get; } = OperatingSystem.IsWindows() ?
#pragma warning disable CA1416 // Validate platform compatibility

Review comment (suggestion):
Just to state this out loud so we're all clear, I believe this means that after getting this change in a patch on a dev machine, ASP.NET Core apps will now require version 5 of the cert to be present. However it won't be created/installed until something forces the SDK first-run experience to run (e.g. running a `dotnet` command) or `dotnet dev-certs https` is run explicitly. I think this is what we want TBC, but want to ensure we're all on the same page.

Code after:
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.Diagnostics.Tracing;
using System.Linq;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Text.Json;
using System.Text.Json.Nodes;
using System.Text.Json.Serialization;

#nullable enable

namespace Microsoft.AspNetCore.Certificates.Generation;

internal abstract class CertificateManager
{
    internal const int CurrentAspNetCoreCertificateVersion = 5;
    internal const int CurrentMinimumAspNetCoreCertificateVersion = 5;

    // OID used for HTTPS certs
    internal const string AspNetHttpsOid = "1.3.6.1.4.1.311.84.1.1";
    internal const string AspNetHttpsOidFriendlyName = "ASP.NET Core HTTPS development certificate";

    private const string ServerAuthenticationEnhancedKeyUsageOid = "1.3.6.1.5.5.7.3.1";
    private const string ServerAuthenticationEnhancedKeyUsageOidFriendlyName = "Server Authentication";

    internal const string SubjectKeyIdentifierOid = "2.5.29.14";
    internal const string AuthorityKeyIdentifierOid = "2.5.29.35";

    // dns names of the host from a container
    private const string LocalhostDockerHttpsDnsName = "host.docker.internal";
    private const string ContainersDockerHttpsDnsName = "host.containers.internal";

    // wildcard DNS names
    private const string LocalhostWildcardHttpsDnsName = "*.dev.localhost";
    private const string InternalWildcardHttpsDnsName = "*.dev.internal";

    // main cert subject
    private const string LocalhostHttpsDnsName = "localhost";
    internal const string LocalhostHttpsDistinguishedName = "CN=" + LocalhostHttpsDnsName;

    public const int RSAMinimumKeySizeInBits = 2048;