Full review and update: Configure certificate authentication in ASP.NET Core

### Description

This article has not been fully updated for a few years and could use a thorough review and possible update.

Possible key issue at a glance, but verify:

1. Code samples target net6.0 but should be updated to target net10.0

- The sample project at aspnetcore/security/authentication/certauth/samples/6.x/ targets net6.0 with package version 6.0.1. The article's >= aspnetcore-6.0 moniker pulls snippets exclusively from this 6.x folder. For an article viewed under ?view=aspnetcore-10.0, the samples should be updated to a 10.x sample project (or at minimum 9.x), targeting the current TFM and NuGet package versions.

- The article uses only two moniker ranges: >= aspnetcore-6.0 and >= aspnetcore-5.0 < aspnetcore-6.0. There's no .NET 9+ or .NET 10+ specific, The article should ideally have a modern sample set and acknowledge current framework versions.

3. Outdated API patterns and links

- The RFC link was updated from tools.ietf.org → datatracker.ietf.org (good), but only in the >= 6.0 moniker — the 5.0 moniker still uses the old link.
- The ListenOptions.UseHttps cross-reference link was updated to #configure-https-in-code, which is correct for current docs.
- The netsh docs link was updated — worth verifying the new anchor #parameters is valid.

4. No mention of newer .NET features

- ConfigurePrimaryHttpMessageHandler is deprecated in favor of ConfigurePrimaryHttpMessageHandler() (generic overload) starting in .NET 8+. The article and sample still use the older pattern.
- No mention of the simplified authentication configuration overloads introduced in .NET 9.
- No mention of .NET 10's security CVE fix (CVE-2026-40372) that affected DataProtection/authentication cookies — relevant if cert auth is combined with cookie auth.

See teams light freshenss update thread on [Light Freshness Edit: ASP.NET - Config Cert Auth by GitHubber17 · Pull Request #37064 · dotnet/AspN…](https://github.com/dotnet/AspNetCore.Docs/pull/37064)

Also see #37064. This was a light freshness thread. blowdart indicated it could use a thorogh review and code may be out date.

### Page URL

https://learn.microsoft.com/en-us/aspnet/core/security/authentication/certauth?view=aspnetcore-10.0

### Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/certauth.md

### Document ID

d2db534b-198a-dc99-5b5a-0525582d39ac

### Platform Id

c04ffbd0-0264-de86-8ac8-5c156c4b4204

### Article author

@blowdart

### Metadata

* ID: 35b7960d-6de5-78ee-bc45-d7218239bbc8
* PlatformId: c04ffbd0-0264-de86-8ac8-5c156c4b4204
* Service: **aspnet-core**
* Sub-service: **security**

[Related Issues](https://github.com/dotnet/AspNetCore.Docs/issues?q=is%3Aissue+is%3Aopen+d2db534b-198a-dc99-5b5a-0525582d39ac)