From cb784cf795f1b23f701cbf42cad4fc49ff65202d Mon Sep 17 00:00:00 2001
From: "aspire-repo-bot[bot]"
 <268009190+aspire-repo-bot[bot]@users.noreply.github.com>
Date: Tue, 22 Sep 2026 19:55:59 +0000
Subject: [PATCH 1/2] docs: document PKCS#12/PFX requirement for resource
 service client certificates

Aligns dashboard/configuration.mdx with the src/Aspire.Dashboard/README.md
update from microsoft/aspire#19565, which switched file-based client
certificate loading to X509CertificateLoader.LoadPkcs12FromFile.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 src/frontend/src/content/docs/dashboard/configuration.mdx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/frontend/src/content/docs/dashboard/configuration.mdx b/src/frontend/src/content/docs/dashboard/configuration.mdx
index 129aeea7a..3afa1b568 100644
--- a/src/frontend/src/content/docs/dashboard/configuration.mdx
+++ b/src/frontend/src/content/docs/dashboard/configuration.mdx
@@ -283,12 +283,16 @@ The resource service client authentication is configured with `Dashboard:Resourc
 | `Dashboard:ResourceServiceClient:AuthMode`<br/>Default: `null` | Can be set to `ApiKey`, `Certificate` or `Unsecured`. `Unsecured` should only be used during local development. It's not recommended when hosting the dashboard publicly or in other settings. This value is required if a resource service URL is specified. |
 | `Dashboard:ResourceServiceClient:ApiKey`<br/>Default: `null` | The API to send to the resource service in the `x-resource-service-api-key` header. This value is required if auth mode is API key. |
 | `Dashboard:ResourceServiceClient:ClientCertificate:Source`<br/>Default: `null` | Can be set to `File` or `KeyStore`. This value is required if auth mode is client certificate. |
-| `Dashboard:ResourceServiceClient:ClientCertificate:FilePath`<br/>Default: `null` | The certificate file path. This value is required if source is `File`. |
+| `Dashboard:ResourceServiceClient:ClientCertificate:FilePath`<br/>Default: `null` | The PKCS#12/PFX certificate file path. The file should contain the client certificate and its private key. This value is required if source is `File`. |
 | `Dashboard:ResourceServiceClient:ClientCertificate:Password`<br/>Default: `null` | The password for the certificate file. This value is optional. |
 | `Dashboard:ResourceServiceClient:ClientCertificate:Subject`<br/>Default: `null` | The certificate subject. This value is required if source is `KeyStore`. |
 | `Dashboard:ResourceServiceClient:ClientCertificate:Store`<br/>Default: `My` | The certificate `X509Certificates.StoreName`. |
 | `Dashboard:ResourceServiceClient:ClientCertificate:Location`<br/>Default: `CurrentUser` | The certificate `X509Certificates.StoreLocation`. |
 
+<Aside type="caution" title="File-based client certificates must be PKCS#12/PFX">
+  File-based client certificate loading uses `X509CertificateLoader.LoadPkcs12FromFile` and accepts only PKCS#12/PFX files, with or without a password. It doesn't accept standalone DER/PEM certificates, PKCS#7 containers, Windows serialized certificates, or Authenticode-signed files. To migrate, export the client certificate and its private key as PKCS#12/PFX, or use `KeyStore` to select an installed certificate with an associated private key.
+</Aside>
+
 ### Telemetry limits
 
 Telemetry is stored in SQLite. To bound the amount of retained telemetry, the dashboard applies limits to each database. Log, trace, and metric retention limits evict the oldest stored values when full; attribute and span-event limits truncate incoming data, and the resource limit rejects telemetry for new resources after the limit is reached.

From ca4c737d709475710b68cd42833152613135d1fb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 23 Sep 2026 03:42:10 +0000
Subject: [PATCH 2/2] docs: remove internal certificate loader detail

Co-authored-by: JamesNK <303201+JamesNK@users.noreply.github.com>
---
 src/frontend/src/content/docs/dashboard/configuration.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/frontend/src/content/docs/dashboard/configuration.mdx b/src/frontend/src/content/docs/dashboard/configuration.mdx
index 3afa1b568..3be3553a3 100644
--- a/src/frontend/src/content/docs/dashboard/configuration.mdx
+++ b/src/frontend/src/content/docs/dashboard/configuration.mdx
@@ -290,7 +290,7 @@ The resource service client authentication is configured with `Dashboard:Resourc
 | `Dashboard:ResourceServiceClient:ClientCertificate:Location`<br/>Default: `CurrentUser` | The certificate `X509Certificates.StoreLocation`. |
 
 <Aside type="caution" title="File-based client certificates must be PKCS#12/PFX">
-  File-based client certificate loading uses `X509CertificateLoader.LoadPkcs12FromFile` and accepts only PKCS#12/PFX files, with or without a password. It doesn't accept standalone DER/PEM certificates, PKCS#7 containers, Windows serialized certificates, or Authenticode-signed files. To migrate, export the client certificate and its private key as PKCS#12/PFX, or use `KeyStore` to select an installed certificate with an associated private key.
+  File-based client certificate loading accepts only PKCS#12/PFX files, with or without a password. It doesn't accept standalone DER/PEM certificates, PKCS#7 containers, Windows serialized certificates, or Authenticode-signed files. To migrate, export the client certificate and its private key as PKCS#12/PFX, or use `KeyStore` to select an installed certificate with an associated private key.
 </Aside>
 
 ### Telemetry limits