Add host.docker.internal and host.containers.internal to the dev cert SAN

[benjaminpetit]

Add host.docker.internal and host.containers.internal to the dev cert SAN

Add necessary SAN for dev container scenario and add an easy to parse output to the dev-certs command.

Description

• Add host.docker.internal and host.containers.internal to the dev cert SAN.
• Bump the certificate version to 3
• Decouple the notion of generated certificate number and minimum acceptable certificate version
• Add new command similar to --check --trust but with json output: --check-json-output

The notion of minimum version is important if/when we backport this feature into dotnet 8 and 9: the runtime in 8 or 9 should be able to run perfectly fine without the new SAN in the cert.

Example of output for a v2 certificate (generated with .NET 9):

[
  {
    "Thumbprint": "D17F51D47E3D8A4FAB0A964B136BF677E469CFB8",
    "Subject": "CN=localhost",
    "X509SubjectAlternativeNameExtension": [
      "localhost"
    ],
    "Version": 2,
    "ValidityNotBefore": "2025-04-02T17:45:49+02:00",
    "ValidityNotAfter": "2026-04-02T17:45:49+02:00",
    "IsHttpsDevelopmentCertificate": true,
    "IsExportable": true,
    "TrustLevel": "Full"
  }
]

Example of output for a v3 certificate:

[
  {
    "Thumbprint": "4C743A4A6588E7C34BEC70DFF7E1A8605D3D68C9",
    "Subject": "CN=localhost",
    "X509SubjectAlternativeNameExtension": [
      "localhost",
      "host.docker.internal",
      "host.containers.internal"
    ],
    "Version": 3,
    "ValidityNotBefore": "2025-04-02T17:51:51+02:00",
    "ValidityNotAfter": "2026-04-02T17:51:51+02:00",
    "IsHttpsDevelopmentCertificate": true,
    "IsExportable": true,
    "TrustLevel": "Full"
  }
]

Fixes #61155

[adityamandaleeka]

Looks good so far!

[Copilot]

Pull Request Overview

This PR updates the certificate generation functionality to include "host.docker.internal" and "host.containers.internal" in the SAN, bumps the certificate version to 3, and adds a new command for JSON output of certificate information.

• Introduces the new --check-json-output option and its logic
• Refactors certificate version handling by separating generated version and minimum acceptable version
• Updates tests and adjusts access modifiers in platform-specific certificate managers

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

File	Description
src/Tools/dotnet-dev-certs/src/Program.cs	Adds new JSON output option and updates certificate filtering on OSX
src/Tools/FirstRunCertGenerator/test/CertificateManagerTests.cs	Updates tests to use the new MinimumAspNetHttpsCertificateVersion property
src/Shared/CertificateGeneration/WindowsCertificateManager.cs, UnixCertificateManager.cs, MacOSCertificateManager.cs	Adjusts access modifiers for the IsExportable method
src/Shared/CertificateGeneration/CertificateManager.cs	Bumps certificate version constants, adds new SAN entries, and introduces the MinimumAspNetHttpsCertificateVersion property

[adityamandaleeka]

This name isn't great... it sounds like it's checking some JSON.

Since we only expect this to be used by tools it feels like a more verbose name is okay... maybe --check-trust-machine-readable or something?

[adityamandaleeka]

I'd expect to see tests here for various permutations of minimum version vs actual version. For instance:

• Multiple certificates with version 1, 2, 3 and minimum set to 2.
• Downgrade scenario where there's a newer cert (say v3) and then the minimum is 2.