This post was most recently updated on March 13th, 2023.
7 min read.This article explains a solution to a rather annoying issue, where certificate validation for builds trying to fetch NuGet packages published by Microsoft fails when using .NET 5. This happens at least with Docker build when you’re relying on some Microsoft-provided images… But probably also in a lot of other cases.
Problem
When running an Azure DevOps pipeline with any task that does any Docker stuff, your build fails. Or if you’ve configured your build differently, perhaps the task just fails. Or if your configuration is even weirder, your task is fine but building the image fails. Plenty of different ways to configure your pipeline, it seems, but the main point is that your log is pretty much full of this fluff:
The author primary signature’s timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
nuget.exe
The author primary signature validity period has expired.
The repository countersignature’s timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
The repository countersignature validity period has expired.
And restoring dependencies in your build – most likely in a Docker container build task – fails.
Below, there’s a bit of logging for you, if you’re interested.
Click to viewI warned you.nuget restore throws SOOOO many kinda unnecessary errors - see for yourself...
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Collections.Concurrent 4.0.12' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Collections.Concurrent 4.0.12' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Text.Encoding.Extensions 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Text.Encoding.Extensions 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Xml.XmlDocument 4.0.1' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Xml.XmlDocument 4.0.1' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Xml.XmlSerializer 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Xml.XmlSerializer 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Text.RegularExpressions 4.1.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Text.RegularExpressions 4.1.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'runtime.native.System 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'runtime.native.System 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.Win32.SystemEvents 4.7.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.Win32.SystemEvents 4.7.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.Win32.SystemEvents 4.7.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.Win32.SystemEvents 4.7.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Xml.ReaderWriter 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Xml.ReaderWriter 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Security.Cryptography.Encoding 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Security.Cryptography.Encoding 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Swashbuckle.AspNetCore 5.6.3' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Swashbuckle.AspNetCore 5.6.3' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.Extensions.DependencyInjection.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.Extensions.DependencyInjection.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.Extensions.DependencyInjection.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.Extensions.DependencyInjection.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.Mvc.NewtonsoftJson 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.Mvc.NewtonsoftJson 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.Mvc.NewtonsoftJson 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.Mvc.NewtonsoftJson 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Security.Cryptography.Algorithms 4.2.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Security.Cryptography.Algorithms 4.2.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.SpaServices.Extensions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.SpaServices.Extensions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.SpaServices.Extensions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.SpaServices.Extensions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Text.Json 4.7.2' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Text.Json 4.7.2' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Text.Json 4.7.2' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Text.Json 4.7.2' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.Authentication.Cookies 2.2.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.Authentication.Cookies 2.2.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.Authentication.Cookies 2.2.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.Authentication.Cookies 2.2.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired. /home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.ApplicationInsights.AspNetCore 2.15.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
But what’s causing this?
Reason
This is kind of a long-standing, classic issue. In my case, it popped up as a combination of having to use .NET 5 instead of .NET 6 or .NET 7, and some Docker images I had no control over.
The issue was originally caused by the certificate that’s used to sign NuGet packages hosted by Microsoft expiring. Minor stuff, but since older versions of .NET 5 have dependencies that apparently now are expired and not trusted unless you can ignore the publisher verification (which you generally shouldn’t do, but perhaps this case is an exception!) your builds might not pass.
Locally, that’s probably something that you can work around. But in Azure DevOps’ build agents? Yeah, that’s a different story!
Solution
This solution should fix the issue in case it’s your Azure DevOps pipelines fail. (If you’re encountering this in a local build, the solution as is won’t work).
Anyway, if you’re using Docker, your default option should be to upgrade your base images for your Docker container. If that’s not possible, check out the steps below:
Time needed: 20 minutes
How to fix NU3028 and NU3037 errors in Azure DevOps builds?
- Add a variable for the SDK version to your pipeline
There are a few ways you can do this:
1) Add a variable to your Pipeline
2) Bind a Variable Group to your Pipeline and add the variable there
3) Add a variable to your YAML file
In any case, we’ll call the variable “SdkVersion“, and it’ll have a value of “5.0.214” (for the latest .NET 5 SDK version). - Add DotNet task
To your YAML file, add a task somewhat like this:
- task: UseDotNet@2
displayName: Use .NET SDK required for project
inputs:
version: $(SdkVersion)
Or, you know, modify your existing task. The main point is to use the variable from earlier. - Rerun your Pipeline
Trigger the pipeline again to see if anything changed.
And with any luck, you should be good!
References
- GitHub -discussion about the issue, with some 400 comments (the fix took a while, some workarounds worked, some didn’t)
- StackOverflow thread: The author’s primary signature’s timestamp found a chain-building issue: UntrustedRoot: self-signed certificate in certificate chain
- Another GitHub issue: The author’s primary signature’s timestamp found a chain building issue: UntrustedRoot: self-signed certificate in certificate chain
- Microsoft’s devblog article about the issue. It provides workarounds that probably don’t do anything anymore.
Developer / Speaker / Consultant at Koskila / Precio Fishbone / Norppandalotti Software Co / Alter - Experience Ideas Ltd
Antti Koskela is a proud digital native nomadic millennial full stack developer (is that enough funny buzzwords? That's definitely enough funny buzzwords!), who works as Solutions Architect for Precio Fishbone, building delightful Digital Workplaces.
He's been a developer from 2004 (starting with PHP and Java), and he's been working on .NET projects, Azure, Office 365, SharePoint and a lot of other stuff. He's also Microsoft MVP for Azure.
This is his personal professional (e.g. professional, but definitely personal) blog.
He's been a developer from 2004 (starting with PHP and Java), and he's been working on .NET projects, Azure, Office 365, SharePoint and a lot of other stuff. He's also Microsoft MVP for Azure.
This is his personal professional (e.g. professional, but definitely personal) blog.
Latest posts by Antti K. Koskela (see all)
