Security Settings
:::info Screenshot needed — light/dark 📸
settings-window-light.png and settings-window-dark.png — Settings Window, custom title bar
:::
The Security tab controls TLS protocol versions, privacy handling of sensitive data, SSL certificate validation, and extension trust policy. A separate Certificate tab manages the TLS development certificate used by service simulation servers.
Changes of security settings won't take effect until the application restarts.
Transport Layer Security (TLS)
Toggle individual TLS protocol versions on or off. These settings apply to all outbound HTTP requests made by Aethrix Studio and are recommended to be kept at TLS 1.2 / 1.3 for security. Older versions (TLS 1.0, TLS 1.1) are outdated and should remain disabled unless a target server requires them.
| Protocol | Default | What it does |
|---|---|---|
| TLS 1.0 | Disabled | Outdated protocol. "TLS 1.0 is outdated. It is recommended to disable it for security reasons." |
| TLS 1.1 | Disabled | Outdated protocol. "TLS 1.1 is outdated. It is recommended to disable it for security reasons." |
| TLS 1.2 | Disabled | Widely supported and secure; enable when the server requires it. |
| TLS 1.3 | Disabled | Latest version with improved security and performance. |
- What it does: Enables or disables a specific TLS protocol version at the .NET
System.Net.Securitylevel for all HTTP clients in the application. - When to use: Enable an older version only if the target server does not support TLS 1.2 or higher. In that case, enable the minimum version required. Keep all newer, secure versions enabled where possible.
- How to set: Open the Security tab → Transport Layer Security (TLS) Settings, toggle each protocol; changes auto-save on close and take effect after restart.
These toggles control the protocol policy at the .NET runtime level. They affect all HTTP clients in the application, not just manual testing requests.
Hide Sensitive Data
- What it does: When enabled (default:
true), Aethrix Studio does not show sensitive data — such as personal and sensitive information — in logs or error messages. If you need to investigate a special case, you should only disable this option during the investigation. - When to use: Keep it enabled in normal operation to avoid leaking secrets (passwords, API keys, PII) into logs and error traces. Temporarily disable it only while diagnosing a specific issue, and re-enable it afterward.
- How to set: Open the Security tab → Hide Sensitive Data, toggle the switch, changes auto-save on close.
Ignore SSL certificate errors
- What it does: When enabled (default:
true), all server certificates are accepted without validation. Useful for dev/staging servers with self-signed certificates. Disable for production environments. - When to use: Enable it against development or staging servers that use self-signed certificates. Disable it for production environments to reject untrusted or expired certificates.
- How to set: Open the Security tab → Ignore SSL certificate errors, toggle the switch, changes auto-save on close and take effect after restart.
Digital signed extensions only
- What it does: When enabled, Aethrix Studio only loads extensions that carry a valid digital signature. Default:
false. - When to use: Enable it in locked-down or enterprise environments to prevent unsigned or tampered
.pkgextensions from loading. Leave it disabled when you intentionally run locally-built or unsigned extensions. - How to set: Open the Security tab → Digital signed extensions only, toggle the switch, changes auto-save on close and take effect after restart.
Development Certificate
The Certificate tab (separate from the Security tab) manages the TLS certificate used by service simulation servers (HTTP and gRPC). The status panel displays:
| Field | Description |
|---|---|
| Status | Present or Not found |
| Subject | Certificate subject (e.g. CN=localhost) |
| Thumbprint | Certificate thumbprint |
| Valid until | Expiration date, with a warning when expiring soon |
| Trusted | Whether the operating system trusts the certificate on this platform (Yes / No) |
Actions:
| Button | Description |
|---|---|
| Initialize | Creates a self-signed development certificate if none exists |
| Trust | Makes the operating system trust the certificate (see the platform notes below) |
| Renew | Replaces the current certificate with a new one |
| Remove | Deletes the certificate and its trust decision |
- What it does: Provisions and manages the self-signed TLS certificate that HTTPS/gRPC service simulation servers present to clients.
- When to use: Initialize a certificate before starting an HTTPS-enabled simulation server. Use Trust on a developer machine so browsers/clients accept it without warnings. Renew when it is near expiry; Remove to clean it up.
- How to set: Open the Certificate tab, click Initialize, then Trust. Refresh the status panel after each action.
:::note Platform differences for Trust The trust decision is installed differently on each platform. Windows: the certificate is added to the CurrentUser Root store; Aethrix must be running as administrator, otherwise the panel shows a "Trust requires administrator privileges" message, and the OS shows a confirmation dialog. macOS: per-user trust settings are recorded silently (no prompt); if the system refuses that, an admin authorization dialog appears to install system-wide trust. Linux: the certificate is added to the per-user trust store that .NET chain building uses — browsers and non-.NET tools keep their own stores. The Trusted field reflects any of these. :::
For service simulation over HTTPS to work, a development certificate must exist. If you start an HTTPS-enabled server without one, the server still runs and serves HTTP: the HTTPS endpoint is not created, and the reason is recorded in that server's Diagnostics. For CI and headless runs, where that approval cannot be granted, aeth cert init --in-memory switches servers to generating a throwaway certificate at each start (not persisted, not trusted, fingerprint changes every run).
Prerequisites for HTTPS Simulation
A development certificate must exist for service simulation over HTTPS. See also Starting & Stopping Servers.
See Also
- General Settings
- Encryption & Security — AES-GCM encryption for test projects