Publishing from Visual Studio 2015 - allow untrusted certificates

Question

I am publishing my ASP.NET 5 MVC6 project from Visual Studio 2015. I have imported publish profile from my server. Connection validates successfully, however when I publish my project I have the following error:

ERROR_CERTIFICATE_VALIDATION_FAILED

Connected to the remote computer ("XXXXXXXXX") using the specified process ("Web Management Service"), but could not verify the server's certificate. If you trust the server, connect again and allow untrusted certificates.

There is no option to allow untrusted certificates in publishing settings.

Solution 1

The option to allow untrusted certificates is not yet supported in the current tooling. Hopefully, this gets updated very soon. You can, however, set it manually.

1. Open the publish profile file (.pubxml) inside /Properties/PublishProfiles in a text editor
2. Inside the <PropertyGroup> element, set AllowUntrustedCertificate to True (<AllowUntrustedCertificate>True</AllowUntrustedCertificate>) or add it if it doesn't exist
3. Set UsePowerShell to False (<UsePowerShell>False</UsePowerShell>).

At this time of writing, the generated powershell script disregards the AllowUntrustedCertificate property which is probably a bug, hence, the need to set it to False.

You can get powershell to work if you update the module version in the .ps1 file.

As a side note, you can also get around this problem by "trusting" the server's certificate locally.

Solution 2

For dot net core 1.0 you have to add the tag

 <AllowUntrustedCertificate>True</AllowUntrustedCertificate>

to publishprofiles in your .pubxml file

Solution 3

I had <UsePowerShell>True</UsePowerShell> but it was still failing with the cert error.

• I re-entered my password in the settings dialog and it still failed
• Once I clicked on Validate Connection it started working.

Note

• VS 2017 (15.2)
• My password recently changed
• As a test, entered the wrong password and I got the cert error so the cert error is not just about an untrusted cert apparently

Solution 4

For me, the solution took 4 lines in the publish profile xml.

<AllowUntrustedCertificate>True</AllowUntrustedCertificate>
<UseMsDeployExe>true</UseMsDeployExe>
<UserName>myuser</UserName>
<Password>mypass</Password>

The UseMsDeployExe changes the error to ignore the certificate, but not authenticate the user, hence the need for the user and pass (of the machine you're deploying to)

No changes were needed in the powershell script.

Solution 5

add this line to your publish profile which existed in the path like in the attached picture

<AllowUntrustedCertificate>True</AllowUntrustedCertificate>

View more solutions

Comments

[koryakinp]

Thank you sir. It solved my original problem, but now I have another error: ERROR_USER_UNAUTHORIZED. "Web deployment task failed. (Connected to the remote computer (XXXX) using the Web Management Service, but could not authorize." The credentials are correct, I believe it is permission issue. Can you give me some insight on how to solve a new error ?

[Dealdiane]

Is the user an admin of the server?

[koryakinp]

Yes. The user is an admin of the server.

[Dealdiane]

I'm afraid there's just too many variables that it's a bit hard to narrow it down to something specific. Normally, if the user is an admin, "it just works". I suggest you create another question. Provide as many detail as you can and perhaps someone more familiar with that error can chime in and help you better. Check this as well. Scroll down to the bottom and make sure you don't miss the section: "TROUBLESHOOTING COMMON ISSUES"

[Serj Sagan]

Can you link to some info about "trusting" a server locally?

[Serj Sagan]

Nm, the info in the 'update the module version' helped me get past that... but now I am getting the ERROR_USER_UNAUTHORIZED error too :(

[Serj Sagan]

I ended up publishing to a local file folder and pushing the files via FTP as a workaround...

[A-Sharabiani]

By updating the module version to 1.0.2-beta2 as is in the link, I get this error: The specified module "" was not loaded because no calid module file was found in any module directory..

[fletchsod]

Awesome! I had been struggling with it til I saw this post.

[Petr Tomášek]

How can I do with MVC 5 and less? This probably works only for dotnet Core. Thanks.

[crthompson]

There seems to be a contradiction here. You say first to set the flag to true, but then say nothing is copied unless the flag is false. Can you clarify?

[Daniel Adigun]

thanks for the observation @paqogomez. please use <UsePowerShell>True</UsePowerShell> . The last statement in my comment was a typo. thanks once again

[Alina]

That's the version that worked for me after thousands of searches and tries.

[Dylan]

In VS 2017.2, this is the only thing that works for me.

[Levi Fuller]

Just came here to post the same solution. Open the publishing settings dialog, re-validate the connection by clicking "Validate Connection", re-save the profile, and click deploy again - this gets me past the certificate issue every time, but I have to do it every time I restart VS - likely a bug.

[spottedmahn]

it certainly feels like a bug! thanks for the note @LeviFuller

[pcdev]

Brilliant! This works for me too. Yes, it appears to be a bug: developercommunity.visualstudio.com/content/problem/64779/…

[spottedmahn]

supposedly this has been fixed in VS 2017 Update 3. thanks for the link @pcdev

[ArieKanarie]

After using this which works, I've found a way to get it work without storing the password in plain text in the profile xml, see: stackoverflow.com/questions/33659696/…

[Juan R]

Working with web api 2. No need store password in profile.xml. UseMsDeployExe was the key. I prefer type it in the window prompt when publising. Thanks.

[ccoutinho]

I have spent a couple of days on this problem, and this was the only way I found to fix the issue.

[spottedmahn]

2nd Dev Community Problem Report: Publish Web App -> could not verify the server’s certificate. They say it was fixed in 15.5 but I still have the problem in 16.1.0 Preview 3 😢.

[Bozhidar Stoyneff]

Yeah, but it doesn't seem to be a permanent solution; it only works for the current session.

[Josh Noe]

Adding only <UseMSDeployExe>True</UseMSDeployExe> without the other three tags worked for me.

[Admin]

Thank you for screen shot, I was wondering where the properties are located