dotnet / dotnet/aspnetcore

Support certificate aliasing in kestrel config

Open
#24,481 2 comments 0 reactions 0 assignees View on GitHub
affected-very-few area-networking enhancement feature-kestrel severity-minor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

Today kestrel's config supports a top level `Certificates` list as well as a `certificate` per endpoint.
https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-3.1#listenoptionsusehttps
```
{
"Kestrel": {
"Certificates": {
"Default": {
"Path": "",
"Password": ""
}
},
"Endpoints": {
"HttpsInlineCertFile": {
"Url": "https://localhost:5001",
"Certificate": {
"Path": "",
"Password": ""
}
},
"HttpsInlineCertStore": {
"Url": "https://localhost:5002",
"Certificate": {
"Subject": "",
"Store": "",
"Location": "",
"AllowInvalid": ""
}
},
"HttpsDefaultCert": {
"Url": "https://localhost:5003"
}
}
}
}
```

However, the `Certificates` list only supports two values, `Default` and `Development`.
https://github.com/dotnet/aspnetcore/blob/f28ef7c3e8bd8c80e5199f5c5c7d95ba5087eaf8/src/Servers/Kestrel/Core/src/KestrelConfigurationLoader.cs#L351
https://github.com/dotnet/aspnetcore/blob/f28ef7c3e8bd8c80e5199f5c5c7d95ba5087eaf8/src/Servers/Kestrel/Core/src/KestrelConfigurationLoader.cs#L378

https://github.com/dotnet/aspnetcore/issues/15144 adds support for multiple certs per endpoint via SNI, but doesn't change anything about the top level `Certificates` collection.

Problem: If a server has multiple endpoints with the same cert, or multiple SNI entries with the same cert, it needs to duplicate that cert in the config for each endpoint or SNI section.

Proposal: Allow the endpoint certificate section (and the new endpoint SNI certificate sections) to reference a cert in the top level `Certificates` collection by name.
```
{
"Kestrel": {
"Certificates": {
"Default": {
"Path": "",
"Password": ""
},
"StoreCert": {
"Subject": "",
"Store": "",
"Location": "",
"AllowInvalid": ""
},
"FileCert": {
"Path": "",
"Password": ""
}
},
"Endpoints": {
"HttpsCertFile": {
"Url": "https://localhost:5001",
"Certificate": {
"Name": "FileCert"
}
},
"HttpsCertStore": {
"Url": "https://localhost:5002",
"Certificate": {
"Name": "StoreCert"
}
},
"HttpsDefaultCert": {
"Url": "https://localhost:5003"
}
}
}
}
```
https://github.com/dotnet/aspnetcore/blob/f28ef7c3e8bd8c80e5199f5c5c7d95ba5087eaf8/src/Servers/Kestrel/Core/src/Internal/ConfigurationReader.cs#L213-L242

@halter73

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.