aspnet:7.0 image fails TLS validation for valid Sectigo certificates (works in aspnet:8.0)

[1agro]

Describe the bug

I'm experiencing TLS validation failures in the official image:
mcr.microsoft.com/dotnet/aspnet:7.0

result:
SSL certificate problem: unable to get local issuer certificate

Which .NET image(s) are you using?

mcr.microsoft.com/dotnet/aspnet:7.0

Steps to reproduce

repro steps:
docker run --rm -it mcr.microsoft.com/dotnet/aspnet:7.0 bash
apt-get update && apt-get install -y curl ca-certificates
curl https://services.siast.com.br

Other information

No response

Output of docker version

Client: Docker Engine - Community
 Version:           28.1.1
 API version:       1.49
 Go version:        go1.23.8
 Git commit:        4eba377
 Built:             Fri Apr 18 09:52:14 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          28.1.1
  API version:      1.49 (minimum version 1.24)
  Go version:       go1.23.8
  Git commit:       01f442b
  Built:            Fri Apr 18 09:52:14 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Output of docker info

[lbussell]

Hi @1agro, .NET 7 reached end of support on May 14, 2024. Using .NET 7 can leave your applications exposed to critical security vulnerabilities. See the .NET support policy for details.

Furthermore, the mcr.microsoft.com/dotnet/aspnet:7.0 image is based on Debian Bullseye which reached end of (mainstream) support on August 14th, 2024. It still receives volunteer support from the Debian Long Term Support group.

Regarding your problem, this is an issue with the Debian Bullseye base image. I was able to reproduce it using amd64/debian:bullseye-slim, even with the latest image version and running apt-get upgrade. It works with the amd64/debian:bookworm-slim image, which mcr.microsoft.com/dotnet/aspnet:8.0 is based on.