Best way for automatic SSL certificate substitution in Kestrel/.NET Core

[ststeiger]

I'm trying to change the SSL certificate at runtime in Kestrel.
Without restarting the process, that is.

I was reading this issue on how to change the SSL certificate on Kestrel
aspnet/KestrelHttpServer#2103

And it just so happens that I was reading about how to host multiple domains on the same kestrel server with SNI.

I mean in the code below, it takes the certs from a dictionary and the certificate-store, but I could easily read them from a pfx/pem file and set a filesystemwatcher on each certificate, and if the SSL-certificate changes, update the dictionary.
I would probably need to change dictionary to concurrentdicionary, though.

I was wondering:
Would that be the correct way to reload SSL-certificates on Kestrel at runtime ?
Or is there an easier way ?

using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;


namespace OnlineYournal
{
    public class Program
    {
        

        public static void Main(string[] args)
        {
            CreateHostBuilder(args).Build().Run();
        } // End Sub Main 


        public static IHostBuilder CreateHostBuilder(string[] args)
        {
            return Host
                .CreateDefaultBuilder(args)
                .ConfigureWebHostDefaults(
                    delegate(IWebHostBuilder webBuilder)
                    {
                        webBuilder.UseStartup<Startup>();
                        // webBuilder.ConfigureKestrel(serverOptions 

                        // https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-5.0#code-try-30
                        webBuilder.ConfigureKestrel(
                                delegate (Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerOptions serverOptions)
                                {
                                    // On Linux, CipherSuitesPolicy can be used to filter TLS handshakes on a per-connection basis:
                                    serverOptions.ConfigureHttpsDefaults(
                                        delegate (Microsoft.AspNetCore.Server.Kestrel.Https.HttpsConnectionAdapterOptions listenOptions)
                                        {
                                            
                                            listenOptions.OnAuthenticate = 
                                                delegate (Microsoft.AspNetCore.Connections.ConnectionContext connectionContext, System.Net.Security.SslServerAuthenticationOptions sslOptions)
                                                {
                                                    sslOptions.CipherSuitesPolicy = new System.Net.Security.CipherSuitesPolicy(
                                                           new System.Net.Security.TlsCipherSuite[]
                                                           {
                                                            System.Net.Security.TlsCipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
                                                            System.Net.Security.TlsCipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
                                                            System.Net.Security.TlsCipherSuite.TLS_CHACHA20_POLY1305_SHA256,
                                                               // ...
                                                           });
                                                }; // End OnAuthenticate 

                                        }); // End ConfigureHttpsDefaults 


                                    // serverOptions.Listen(System.Net.IPAddress.Loopback, 5001,
                                    serverOptions.ListenAnyIP(5005, 
                                        delegate (Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions listenOptions)
                                        {
                                            // listenOptions.UseHttps("testCert.pfx", "testPassword");

                                            

                                            listenOptions.UseHttps(
                                                delegate (Microsoft.AspNetCore.Server.Kestrel.Https.HttpsConnectionAdapterOptions httpsOptions)
                                                {
                                                    System.Security.Cryptography.X509Certificates.X509Certificate2 localhostCert = Microsoft.AspNetCore.Server.Kestrel.Https.CertificateLoader.LoadFromStoreCert(
                                                        "localhost", "My", System.Security.Cryptography.X509Certificates.StoreLocation.CurrentUser,
                                                        allowInvalid: true);

                                                    System.Security.Cryptography.X509Certificates.X509Certificate2 exampleCert = Microsoft.AspNetCore.Server.Kestrel.Https.CertificateLoader.LoadFromStoreCert(
                                                        "example.com", "My", System.Security.Cryptography.X509Certificates.StoreLocation.CurrentUser,
                                                        allowInvalid: true);

                                                    System.Security.Cryptography.X509Certificates.X509Certificate2 subExampleCert = Microsoft.AspNetCore.Server.Kestrel.Https.CertificateLoader.LoadFromStoreCert(
                                                        "sub.example.com", "My", System.Security.Cryptography.X509Certificates.StoreLocation.CurrentUser,
                                                        allowInvalid: true);

                                                    System.Collections.Generic.Dictionary<string, System.Security.Cryptography.X509Certificates.X509Certificate2> certs = 
                                                        new System.Collections.Generic.Dictionary<string, System.Security.Cryptography.X509Certificates.X509Certificate2>(
                                                            System.StringComparer.OrdinalIgnoreCase
                                                    );

                                                    certs["localhost"] = localhostCert;
                                                    certs["example.com"] = exampleCert;
                                                    certs["sub.example.com"] = subExampleCert;


                                                    httpsOptions.ServerCertificateSelector = 
                                                        delegate(Microsoft.AspNetCore.Connections.ConnectionContext connectionContext, string name) 
                                                        {
                                                            if (name != null && certs.TryGetValue(name, out var cert))
                                                            {
                                                                return cert;
                                                            }

                                                            return exampleCert;
                                                        };

                                                }); // End ListenOptions.UseHttps

                                        }); // End ListenAnyIp 

                                }) // End ConfigureKestrel 
                        ;

                    } // End ConfigureWebHostDefaults 
                )
            ;
        } // End Function CreateHostBuilder 


    } // End Class Program 


} // End Namespace OnlineYournal 

[Tratcher]

That would work, but 5.0 has a new way to do this via reloadable config. (Docs still in progress)
#26241
#26242

[ststeiger]

@Tratcher:
But, that would only work if the name of the config-file changed, right ?
If only the KEY-file changes, that wouldn't change the config-file.
(key-file filename referenced in reloadable kestrel-config as in pull #24286)

{
  "Kestrel": {
    "Endpoints": {
      "EndpointName": {
        "Url": "https://*",
        "Sni": {
          "a.example.org": {
            "Protocols": "Http1AndHttp2",
            "SslProtocols": [ "Tls11", "Tls12", "Tls13"],
            "Certificate": {
              "Path": "testCert.pfx",
              "Password": "testPassword"
            },
            "ClientCertificateMode" : "NoCertificate"
          },
          "*.example.org": {
            "Certificate": {
              "Path": "testCert2.pfx",
              "Password": "testPassword"
            }
          },
          "*": {
            // At least one subproperty needs to exist per SNI section or it
            // cannot be discovered via IConfiguration
            "Protocols": "Http1",
          }
        }
      }
    }
  }
}

[Tratcher]

That's a good point, yes, part of the cert would need to change in the config file for the change to be detected. @halter73

Listening to changes for individual cert files would be pretty hard and could cause some noisy reloads if multiple certs were updated. I also don't know how we'd do it for store based certs.

Another way we could address this is to add something like a revision field to the Certificate node that you could modify when you were ready to trigger a reload of that cert. Does that sound feasible for your scenario?