dotnet / dotnet/aspnetcore

Allow passing base64 pfx content as HTTPS certificate

Open
#52,062 0 comments 0 reactions 0 assignees View on GitHub
area-networking feature-kestrel
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

I am trying to apply the HTTPS certificate stored in Azure KeyVault with Krestel server using KeyVault Configuration Provider. By KeyVault Configuration Provider, certificates could be retrieved as secrets in base64-pfx format, while Krestel configuration does not support passing the base64 pfx content directly. Now I have to do either:

Suppose I store the certificate in Azure KeyVault with name `Krestel--Certificates--Default--Content`

```C#
// Program.cs

File.WriteAllBytes("https.pfx", Convert.FromBase64String(builder.Configuration["Krestel:Certiticates:Default:Content"]));
```

```json
{
"//": "appsettings.json",
"Krestel": {
"Certificates": {
"Default": {
"Path": "https.pfx"
}
}
}
}
```

or

```C#
// Program.cs

builder.Services.Configure(options =>
{
options.ConfigureHttpsDefaults(httpsOptions =>
{
httpsOptions.ServerCertificate = new(Convert.FromBase64String(builder.Configuration["Krestel:Certificates:Default:Content"]));
});
});
```

### Describe the solution you'd like

It will be great if we can directly support the key like `Krestel:Certificates:Default:Content` with base64 encoded pfx format. This will make we migrate from http to https with certs in Azure KeyVault more smoothly - no need to change the code and recompile or write some preprocesses to download the cert to local, just add some fields to configuration and all set.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.