microsoft / microsoft/aspire

Allow configuring/overriding dashboard and other endpoint certificates (BYO SSL)

Open
#7,627 6 comments 3 reactions 0 assignees View on GitHub
area-dashboard
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 15h
Merged PRs (30d)
196

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

This is related to problem https://github.com/dotnet/aspire/issues/4131. I am setting up our distributed solution with two launch profiles - one running projects on the developer machine, and one running everything as containers (as we host our end product on kubernetes). In either solution we are generating our own certificates for https and trusting them in containers to facilitate secure communication.

However the aspire dashboard and related endpoints uses the dev cert and only the dev cert with no apparent way to override. This means that our containers are unable to communicate via https to aspire endpoints, and we are forced to set unsecured communication for features like OLTP.

### Describe the solution you'd like

TLDR; Request the ability to set the certificate for https bindings for aspire dashboard and related endpoints like we can any other kestrel hosted web application.

Because of the above issue with dashboard via a project using the dev certificate, we are currently running on http for OLTP exporting to the dashboard. We would prefer to go over https, and see two possibilities to solve this:

1. (Preferred and the point of this ticket) - it would be great to specify the ssl certificate for the aspire dashboard like you can for most other kestrel applications. I tried setting the Kestrel configuration block in app settings but it was ignored. I inspected the entire aspire dashboard configuration and did not see anything obvious to override.
2. (less ideal but we may be pursuing until we can specify the cert for aspire dashboard) the dev cert generated seems to be always called CN=localhost - we can pull this cert and add it to container as well as our generated certs we are already using, so our core apps can trust the certificate. I suspect however this will most likely fail anyways as the cert only has localhost as cn or subject alternative name, and would not include the docker internal host.

So even though we have considered these two approaches, really only 1 seems viable. Being able to BYO certificate for the dashboard would allow a safe solution the OLTP https issue and any other communication issues between aspire endpoints and containers.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.