Repository: dotnet/aspnetcore
File: src/Shared/CertificateGeneration/UnixCertificateManager.cs (C#)

Code before:

            var prettyCertDir = certDir.StartsWith(homeDirectoryWithSlash, StringComparison.Ordinal)
                ? Path.Combine("$HOME", certDir[homeDirectoryWithSlash.Length..])
                : certDir;

            if (TryGetOpenSslDirectory(out var openSslDir))
            {
                Log.UnixSuggestSettingEnvironmentVariable(prettyCertDir, Path.Combine(openSslDir, "certs"), OpenSslCertificateDirectoryVariableName);
            }
            else
            {
                Log.UnixSuggestSettingEnvironmentVariableWithoutExample(prettyCertDir, OpenSslCertificateDirectoryVariableName);
            }
        }

        // Check to see if we're running in WSL; if so, use powershell.exe to add the certificate to the Windows trust store as well
        if (IsRunningOnWslWithInterop())
        {
            if (TryTrustCertificateInWindowsStore(certificate))
            {
                Log.WslWindowsTrustSucceeded();
                sawTrustSuccess = true;
            }
            else
            {
                Log.WslWindowsTrustFailed();
                sawTrustFailure = true;
            }
        }

        return sawTrustFailure
            ? TrustLevel.Partial
            : TrustLevel.Full;
    }

    protected override void RemoveCertificateFromTrustedRoots(X509Certificate2 certificate)
    {
        var sawUntrustFailure = false;

        using var store = new X509Store(StoreName.Root, StoreLocation.CurrentUser);
        store.Open(OpenFlags.ReadWrite);

        if (TryFindCertificateInStore(store, certificate, out var matching))
        {
            try
            {
                store.Remove(matching);
            }
            catch (Exception ex)
            {
                Log.UnixDotnetUntrustException(ex.Message);

Review comment (bug):
nit: If there was an exception then 2 warning logs will display, e.g.
> Failed to trust the certificate in the Windows certificate store via WSL: AccessDenied.
> Failed to trust the certificate in the Windows certificate store via WSL.

Code after:

            var prettyCertDir = certDir.StartsWith(homeDirectoryWithSlash, StringComparison.Ordinal)
                ? Path.Combine("$HOME", certDir[homeDirectoryWithSlash.Length..])
                : certDir;

            var hasValidSslCertDir = false;

            // Check if SSL_CERT_DIR is already set and if certDir is already included
            var existingSslCertDir = Environment.GetEnvironmentVariable(OpenSslCertificateDirectoryVariableName);
            if (!string.IsNullOrEmpty(existingSslCertDir))
            {
                var existingDirs = existingSslCertDir.Split(Path.PathSeparator);
                var certDirFullPath = Path.GetFullPath(certDir);
                var isCertDirIncluded = existingDirs.Any(dir =>
                {
                    if (string.IsNullOrWhiteSpace(dir))
                    {
                        return false;
                    }

                    try
                    {
                        return string.Equals(Path.GetFullPath(dir), certDirFullPath, StringComparison.Ordinal);
                    }
                    catch
                    {
                        // Ignore invalid directory entries in SSL_CERT_DIR
                        return false;
                    }
                });

                if (isCertDirIncluded)
                {
                    // The certificate directory is already in SSL_CERT_DIR, no action needed
                    Log.UnixOpenSslCertificateDirectoryAlreadyConfigured(prettyCertDir, OpenSslCertificateDirectoryVariableName);
                    hasValidSslCertDir = true;
                }
                else
                {
                    // SSL_CERT_DIR is set but doesn't include our directory - suggest appending
                    Log.UnixSuggestAppendingToEnvironmentVariable(prettyCertDir, OpenSslCertificateDirectoryVariableName);
                    hasValidSslCertDir = false;
                }
            }
            else if (TryGetOpenSslDirectory(out var openSslDir))
            {
                Log.UnixSuggestSettingEnvironmentVariable(prettyCertDir, Path.Combine(openSslDir, "certs"), OpenSslCertificateDirectoryVariableName);
                hasValidSslCertDir = false;
            }
            else
            {