UnixCertificateManager: implement IsTrusted.

[tmds]

Consider the certificate trusted when .NET trusts it.

@davidfowl ptal.

[tmds]

This is to omit the following warning when a development cert has been installed through https://github.com/tmds/linux-dev-certs.

The ASP.NET Core developer certificate is not trusted. For information about trusting the ASP.NET Core developer certificate, see https://aka.ms/aspnet/https-trust-dev-cert.

When UnixCertificateManager.TrustCertificateCore is implemented, the IsTrusted implementation can be changed to match.
Until then, using the .NET API can be a meaningful implementation.

[amcasey]

What validation does this perform? Just that the certificates in the chain are available and unexpired?

[amcasey]

Wait, is this check used exclusively to decide whether or not to print that warning?
https://source.dot.net/#Microsoft.AspNetCore.Server.Kestrel.Core/src/Shared/CertificateGeneration/CertificateManager.cs,a513168894adcdad,references

[tmds]

What validation does this perform? Just that the certificates in the chain are available and unexpired?

As implemented, this check tells us if HttpClient will accept the development certificate for localhost or not.

Wait, is this check used exclusively to decide whether or not to print that warning?

That, and there is another call in dev-certs itself:

aspnetcore/src/Tools/dotnet-dev-certs/src/Program.cs

Lines 298 to 315 in 08e84a2

	if (!RuntimeInformation.IsOSPlatform(OSPlatform.Linux))
	{
	var trustedCertificates = certificates.Where(certificateManager.IsTrusted).ToList();
	if (!trustedCertificates.Any())
	{
	reporter.Output($@"The following certificates were found, but none of them is trusted: {CertificateManager.ToCertificateDescription(certificates)}");
	return ErrorCertificateNotTrusted;
	}
	else
	{
	ReportCertificates(reporter, trustedCertificates, "trusted");
	}
	}
	else
	{
	reporter.Warn("Checking the HTTPS development certificate trust status was requested. Checking whether the certificate is trusted or not is not supported on Linux distributions." +
	"For instructions on how to manually validate the certificate is trusted on your Linux distribution, go to https://aka.ms/dev-certs-trust");
	}

I don't have a strong opinion on whether this one should be updated (to no longer special case Linux) or not.

[amcasey]

Why disable revocation checking? Perf?

[tmds]

X509Chain uses Online as the default and SocketsHttpHandler uses NoCheck as the default.

If we don't set this to NoCheck then verification fails because the local certificates have no online revocation list to check against.