Support certificate aliasing in kestrel config
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
Today kestrel's config supports a top level `Certificates` list as well as a `certificate` per endpoint.
https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-3.1#listenoptionsusehttps
```
{
"Kestrel": {
"Certificates": {
"Default": {
"Path": "",
"Password": ""
}
},
"Endpoints": {
"HttpsInlineCertFile": {
"Url": "https://localhost:5001",
"Certificate": {
"Path": "",
"Password": ""
}
},
"HttpsInlineCertStore": {
"Url": "https://localhost:5002",
"Certificate": {
"Subject": "",
"Store": "",
"Location": "",
"AllowInvalid": ""
}
},
"HttpsDefaultCert": {
"Url": "https://localhost:5003"
}
}
}
}
```
However, the `Certificates` list only supports two values, `Default` and `Development`.
https://github.com/dotnet/aspnetcore/blob/f28ef7c3e8bd8c80e5199f5c5c7d95ba5087eaf8/src/Servers/Kestrel/Core/src/KestrelConfigurationLoader.cs#L351
https://github.com/dotnet/aspnetcore/blob/f28ef7c3e8bd8c80e5199f5c5c7d95ba5087eaf8/src/Servers/Kestrel/Core/src/KestrelConfigurationLoader.cs#L378
https://github.com/dotnet/aspnetcore/issues/15144 adds support for multiple certs per endpoint via SNI, but doesn't change anything about the top level `Certificates` collection.
Problem: If a server has multiple endpoints with the same cert, or multiple SNI entries with the same cert, it needs to duplicate that cert in the config for each endpoint or SNI section.
Proposal: Allow the endpoint certificate section (and the new endpoint SNI certificate sections) to reference a cert in the top level `Certificates` collection by name.
```
{
"Kestrel": {
"Certificates": {
"Default": {
"Path": "",
"Password": ""
},
"StoreCert": {
"Subject": "",
"Store": "",
"Location": "",
"AllowInvalid": ""
},
"FileCert": {
"Path": "",
"Password": ""
}
},
"Endpoints": {
"HttpsCertFile": {
"Url": "https://localhost:5001",
"Certificate": {
"Name": "FileCert"
}
},
"HttpsCertStore": {
"Url": "https://localhost:5002",
"Certificate": {
"Name": "StoreCert"
}
},
"HttpsDefaultCert": {
"Url": "https://localhost:5003"
}
}
}
}
```
https://github.com/dotnet/aspnetcore/blob/f28ef7c3e8bd8c80e5199f5c5c7d95ba5087eaf8/src/Servers/Kestrel/Core/src/Internal/ConfigurationReader.cs#L213-L242
@halter73
Contributor guide
Assessment
This issue has not been assessed yet.