on SSH Remote from Windows to Mac, after updating to 13.2.1, I get AppleCommonCryptoCryptographicException

[burtonrodman]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I run VS Code on Windows 11, with an SSH Remote to a project on my Mac Studio.
Prior to 13.2, I hit F5 and the Dashboard launches locally (on Windows).

After updating to 13.2.1 (from 13.1.0), I get the following exception launching the project...

info: Aspire.Hosting.DistributedApplication[0]
      Aspire version: 13.2.1+14bf8c40443c690189a82ecb6565edb91dadf3b1
Aspire.Hosting.DistributedApplication: Information: Aspire version: 13.2.1+14bf8c40443c690189a82ecb6565edb91dadf3b1
Aspire.Hosting.DistributedApplication: Information: Distributed application starting.
info: Aspire.Hosting.DistributedApplication[0]
      Distributed application starting.
info: Aspire.Hosting.DistributedApplication[0]
      Application host directory is: /Users/burtonrodman/source/redacted/redacted/redacted/aspire/redacted.AppHost
Aspire.Hosting.DistributedApplication: Information: Application host directory is: /Users/burtonrodman/source/redacted/redacted/redacted/aspire/redacted.AppHost
fail: Aspire.Hosting.Dashboard[0]
      2026-03-31T16:26:18.5168110Z Failed to create resource aspire-dashboard
      Interop+AppleCrypto+AppleCommonCryptoCryptographicException: User interaction is not allowed.
         at Interop.AppleCrypto.SecKeyExportData(SafeSecKeyRefHandle key, Boolean exportPrivate, ReadOnlySpan`1 password)
         at System.Security.Cryptography.X509Certificates.AppleCertificatePal.ExportPkcs8(SafeSecKeyRefHandle key, ReadOnlySpan`1 password)
         at System.Security.Cryptography.X509Certificates.AppleCertificatePal.ExportPkcs8(ReadOnlySpan`1 password)
         at System.Security.Cryptography.X509Certificates.UnixExportProvider.BuildBags(ICertificatePalCore certPal, ReadOnlySpan`1 passwordSpan, AsnWriter tmpWriter, CertBagAsn[] certBags, AttributeAsn[] certAttrs, SafeBagAsn[] keyBags, Int32& certIdx, Int32& keyIdx)
         at System.Security.Cryptography.X509Certificates.UnixExportProvider.ExportPfx(SafePasswordHandle password)
         at System.Security.Cryptography.X509Certificates.AppleCertificatePal.Export(X509ContentType contentType, SafePasswordHandle password)
         at System.Security.Cryptography.X509Certificates.X509Certificate.Export(X509ContentType contentType, String password)
         at Aspire.Hosting.Dcp.DcpExecutor.GetCertificateKeyMaterialAsync(HttpsCertificateExecutionConfigurationData configuration, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/DcpExecutor.cs:line 2853
         at Aspire.Hosting.Dcp.DcpExecutor.CreateExecutableAsync(RenderedModelResource er, ILogger resourceLogger, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/DcpExecutor.cs:line 1736
         at Aspire.Hosting.Dcp.DcpExecutor.CreateResourceExecutablesAsyncCore(IResource resource, IEnumerable`1 executables, Func`4 createResourceFunc, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/DcpExecutor.cs:line 1575
Aspire.Hosting.Dashboard: Error: 2026-03-31T16:26:18.5168110Z Failed to create resource aspire-dashboard
Interop+AppleCrypto+AppleCommonCryptoCryptographicException: User interaction is not allowed.
   at Interop.AppleCrypto.SecKeyExportData(SafeSecKeyRefHandle key, Boolean exportPrivate, ReadOnlySpan`1 password)
   at System.Security.Cryptography.X509Certificates.AppleCertificatePal.ExportPkcs8(SafeSecKeyRefHandle key, ReadOnlySpan`1 password)
   at System.Security.Cryptography.X509Certificates.AppleCertificatePal.ExportPkcs8(ReadOnlySpan`1 password)
   at System.Security.Cryptography.X509Certificates.UnixExportProvider.BuildBags(ICertificatePalCore certPal, ReadOnlySpan`1 passwordSpan, AsnWriter tmpWriter, CertBagAsn[] certBags, AttributeAsn[] certAttrs, SafeBagAsn[] keyBags, Int32& certIdx, Int32& keyIdx)
   at System.Security.Cryptography.X509Certificates.UnixExportProvider.ExportPfx(SafePasswordHandle password)
   at System.Security.Cryptography.X509Certificates.AppleCertificatePal.Export(X509ContentType contentType, SafePasswordHandle password)
   at System.Security.Cryptography.X509Certificates.X509Certificate.Export(X509ContentType contentType, String password)
   at Aspire.Hosting.Dcp.DcpExecutor.GetCertificateKeyMaterialAsync(HttpsCertificateExecutionConfigurationData configuration, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/DcpExecutor.cs:line 2853
   at Aspire.Hosting.Dcp.DcpExecutor.CreateExecutableAsync(RenderedModelResource er, ILogger resourceLogger, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/DcpExecutor.cs:line 1736
   at Aspire.Hosting.Dcp.DcpExecutor.CreateResourceExecutablesAsyncCore(IResource resource, IEnumerable`1 executables, Func`4 createResourceFunc, CancellationToken cancellationToken) in /_/src/Aspire.Hosting/Dcp/DcpExecutor.cs:line 1575
info: Aspire.Hosting.DistributedApplication[0]
      Distributed application started. Press Ctrl+C to shut down.
Aspire.Hosting.DistributedApplication: Information: Distributed application started. Press Ctrl+C to shut down.

Expected Behavior

No response

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version info

No response

Anything else?

No response

[MihuBot]

I'm a bot. Here is a possible related and/or duplicate issue (I may be wrong):

• Certificate store issues on OSX dotnet/runtime#21979

[danegsta]

In 13.2 we updated how we expose the dev cert to the dashboard to ensure we're using the logic from Aspire (instead of the default ASP.NET logic) to ensure we're using a known trusted certificate (the default ASP.NET logic doesn't actually validate that the certificate used is fully trusted). But this means we aren't taking advantage of the cached ASP.NET copy of the dev cert and need to access it at least once from the keychain. Unfortunately, there's no way to access a private key from the keychain without at least one user prompt which isn't working over SSH (hence the Interop+AppleCrypto+AppleCommonCryptoCryptographicException: User interaction is not allowed. error).

To fix you'd need to remote in with full GUI access (or access the machine directly) such that you can approve the access to the developer certificate. If you select always allow when granting permission it'll persist the setting and things should work over SSH again. Mac caches the permissions per-application, so you may have to repeat the process if you work with multiple app hosts. I'll take a look at whether there are any options we can consider on Mac to streamline this.