Improve Linux dev certificate trust handling

src/Aspire.Cli/Certificates/CertificateGeneration/UnixCertificateManager.cs

@@ -5,6 +5,7 @@
 
 using System.Diagnostics;
 using System.Diagnostics.CodeAnalysis;
+using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using System.Text.RegularExpressions;
 using Aspire.Cli;
@@ -116,11 +117,19 @@ public override TrustLevel GetTrustLevel(X509Certificate2 certificate)
                 var certPath = Path.Combine(sslCertDir, certificateNickname + ".pem");
                 if (File.Exists(certPath))
                 {
-                    using var candidate = X509CertificateLoader.LoadCertificateFromFile(certPath);
-                    if (AreCertificatesEqual(certificate, candidate))
+                    try
                     {
-                        foundCert = true;
-                        break;
+                        using var candidate = X509CertificateLoader.LoadCertificateFromFile(certPath);
+                        if (AreCertificatesEqual(certificate, candidate))
+                        {
+                            foundCert = true;
+                            break;
+                        }
+                    }
+                    catch (Exception ex) when (ex is CryptographicException or IOException or UnauthorizedAccessException)
+                    {
+                        // Treat unreadable entries as a miss. A later SSL_CERT_DIR entry may still contain
+                        // the expected certificate, so only report OpenSSL as untrusted after the full search.
                     }
                 }
             }
@@ -476,18 +485,20 @@ protected override void RemoveCertificateFromTrustedRoots(X509Certificate2 certi
         if (File.Exists(certPath))
         {
             var openSslUntrustSucceeded = false;
+            var certificateFileDeleted = TryDeleteCertificateFile(certPath);
 
-            if (IsCommandAvailable(OpenSslCommand))
+            if (certificateFileDeleted)
             {
-                if (TryDeleteCertificateFile(certPath) && TryRehashOpenSslCertificates(certDir))
+                if (IsCommandAvailable(OpenSslCommand))
+                {
+                    openSslUntrustSucceeded = TryRehashOpenSslCertificates(certDir);
+                }
+                else
                 {
+                    Log.UnixMissingOpenSslCommand(OpenSslCommand);
                     openSslUntrustSucceeded = true;
                 }
             }
-            else
-            {
-                Log.UnixMissingOpenSslCommand(OpenSslCommand);
-            }
 
             if (openSslUntrustSucceeded)
             {

src/Aspire.Cli/Resources/DoctorCommandStrings.resx

@@ -155,6 +155,10 @@
     <value>Run '{0}' to remove all certificates, then run '{1}' to create and trust a new one.</value>
     <comment>{0} is the aspire certs clean command, {1} is the aspire certs trust command (not localizable)</comment>
   </data>
+  <data name="DevCertsInstallOpenSslCleanAndTrustFixFormat" xml:space="preserve">
+    <value>Install {0}, run '{1}' to remove all certificates, then run '{2}' to create and trust a new one.</value>
+    <comment>{0} is the openssl command/package name, {1} is the aspire certs clean command, {2} is the aspire certs trust command (not localizable)</comment>
+  </data>
   <data name="DevCertsMultipleNoneTrustedMessageFormat" xml:space="preserve">
     <value>Multiple HTTPS development certificates found ({0} certificates), but none are trusted</value>
   </data>
@@ -200,6 +204,27 @@
   <data name="DevCertsMissingCertUtilFix" xml:space="preserve">
     <value>Install certutil from your distribution's NSS tools package (for example, libnss3-tools).</value>
   </data>
+  <data name="DevCertsOpenSslCacheMissingCurrentCertificateMessage" xml:space="preserve">
+    <value>OpenSSL HTTPS development certificate cache is missing the current certificate</value>
+  </data>
+  <data name="DevCertsOpenSslCacheMissingDetailsFormat" xml:space="preserve">
+    <value>The OpenSSL certificate cache at '{0}' does not contain certificate {1} from the .NET current user certificate store. Run 'aspire certs clean' and then 'aspire certs trust' to remove stale or corrupt certificates and regenerate trusted development certificates.</value>
+    <comment>{0} is the OpenSSL certificate cache directory. {1} is the certificate thumbprint.</comment>
+  </data>
+  <data name="DevCertsOpenSslCacheUnreadableMessage" xml:space="preserve">
+    <value>OpenSSL HTTPS development certificate cache contains unreadable certificate files</value>
+  </data>
+  <data name="DevCertsOpenSslCacheUnreadableFilesDetailsFormat" xml:space="preserve">
+    <value>Could not read certificate files under '{0}': {1}. Run 'aspire certs clean' and then 'aspire certs trust' to remove stale or corrupt certificates and regenerate trusted development certificates.</value>
+    <comment>{0} is the OpenSSL certificate cache directory. {1} is a comma-separated list of certificate file names.</comment>
+  </data>
+  <data name="DevCertsOpenSslCacheMissingHashLinkMessage" xml:space="preserve">
+    <value>OpenSSL HTTPS development certificate cache is missing subject-hash links</value>
+  </data>
+  <data name="DevCertsOpenSslCacheMissingHashLinkDetailsFormat" xml:space="preserve">
+    <value>The OpenSSL certificate cache at '{0}' contains certificate {1}, but no subject-hash entry points to it. OpenSSL workloads use subject-hash entries when loading CA directories.</value>
+    <comment>{0} is the OpenSSL certificate cache directory. {1} is the certificate thumbprint.</comment>
+  </data>
   <data name="DcpBundleNotFoundMessage" xml:space="preserve">
     <value>Developer Control Plane (DCP) bundle not found; skipping connection health checks</value>
   </data>