Initial app start certificate error

[adambajguz]

Describe the bug
Hello, when the application starts for the first time e.g. in Docker, and there's no certificate to fallback I receive this error:

System.InvalidOperationException: Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date.
To generate a developer certificate run 'dotnet dev-certs https'. To trust the certificate (Windows and macOS only) run 'dotnet dev-certs https --trust'.
For more information on configuring HTTPS see https://go.microsoft.com/fwlink/?linkid=848054.
   at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.UseHttps(ListenOptions listenOptions, Action`1 configureOptions)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context, CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(ListenOptions[] listenOptions, AddressBindContext context, Func`2 useHttps, CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.BindAsync(CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServerImpl.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)
   at Microsoft.Extensions.Hosting.Internal.Host.<StartAsync>b__15_1(IHostedService service, CancellationToken token)
   at Microsoft.Extensions.Hosting.Internal.Host.ForeachService[T](IEnumerable`1 services, CancellationToken token, Boolean concurrent, Boolean abortOnFirstException, List`1 exceptions, Func`3 operation)
   at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken)
   at PackSite.Library.Logging.BootstrappedHost.StartAsync(CancellationToken cancellationToken)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)

To Reproduce
Steps to reproduce the behavior:

1. Run https://github.com/natemcmaster/LettuceEncrypt/tree/main/samples/Web in an environemnt that doesn't have any fallback certificate (developer ceertificate).

Expected behavior
I'd expect that Kestrel will expose HTTP endpoing and not throw any exception until the certificate is generated by the library.

[adambajguz]

@natemcmaster Any updates on this issue?

[bar10dr]

Same problem

[bar10dr]

I decided to RTFM and found out that the problem was between the computer and the chair.

builder.WebHost.ConfigureKestrel(serverOptions =>
{
 var appServices = serverOptions.ApplicationServices;
 serverOptions.ConfigureHttpsDefaults(h =>
 {
  h.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
  h.UseLettuceEncrypt(appServices);
 });
});

builder.Services
	.AddLettuceEncrypt()
	.PersistDataToDirectory(new DirectoryInfo("/mydirectory/"), "mypassword");

[adambajguz]

I currently use a temporaary self-signed certficate created on the fly to make Kestrel start.

    hostBuilder
        .ConfigureAppConfiguration(static (builder) =>
            {           
                    // TODO: clear sources
  
                    SelfSignedCertificateHelper.TryInitializeAndGetPassword(
                        "My Application",
                        "initial-certificate.pfx",
                        "/https/certs/self-signed");

                    context.AddInMemoryCollection(new Dictionary<string, string?>
                    {
                        ["Certificates:Default:Path"] = "/https/certs/self-signed/initial-certificate.pfx",
                        ["Certificates:Default:KeyPath"] = "/https/certs/self-signed/initial-certificate.pfx.key",
                    });

                    // TODO: add default sources
            })

using System.IO;
    using System.Security.Cryptography;
    using System.Security.Cryptography.X509Certificates;

    /// <summary>
    /// Self signed certificate helper.
    /// </summary>
    public class SelfSignedCertificateHelper
    {
        /// <summary>
        /// Tries to initialize and get password.
        /// </summary>
        /// <param name="certificateName"></param>
        /// <param name="certificatePfxFileName"></param>
        /// <param name="store"></param>
        /// <returns></returns>
        public static string TryInitializeAndGetPassword(string certificateName, string certificatePfxFileName, string store)
        {
            return TryInitializeAndGetPassword(certificateName, certificatePfxFileName, Directory.CreateDirectory(store));
        }

        /// <summary>
        /// Tries to initialize and get password.
        /// </summary>
        /// <param name="certificateName"></param>
        /// <param name="certificatePfxFileName"></param>
        /// <param name="store"></param>
        /// <returns></returns>
        private static string TryInitializeAndGetPassword(string certificateName, string certificatePfxFileName, DirectoryInfo store)
        {
            ArgumentException.ThrowIfNullOrWhiteSpace(certificateName);
            ArgumentException.ThrowIfNullOrWhiteSpace(certificatePfxFileName);
            ArgumentNullException.ThrowIfNull(store);

            if (!certificatePfxFileName.EndsWith(".pfx"))
            {
                certificatePfxFileName = $"{certificatePfxFileName}.pfx";
            }

            FileInfo[] files = store.GetFiles();

            if (files.Any(x => x.Name == certificatePfxFileName) &&
                files.FirstOrDefault(x => x.Name == $"{certificatePfxFileName}.key") is { } passFileInfo)
            {
                string password = File.ReadAllText(passFileInfo.FullName);

                return password.Trim();
            }

            string newPassword = RandomNumberGenerator.GetHexString(48);

            X509Certificate2 certificate = GenerateSelfSignedCertificate(certificateName, newPassword);
            byte[] certData = certificate.Export(X509ContentType.Pfx, newPassword);

            File.WriteAllBytes($"{store.FullName}{Path.PathSeparator}{certificatePfxFileName}", certData);
            File.WriteAllText($"{store.FullName}{Path.PathSeparator}{certificatePfxFileName}.key", newPassword);

            return newPassword;
        }

        /// <summary>
        /// Generates a self signed certificate.
        /// </summary>
        /// <param name="certificateName"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        public static X509Certificate2 GenerateSelfSignedCertificate(string certificateName, string password)
        {
            ArgumentException.ThrowIfNullOrWhiteSpace(certificateName);
            ArgumentException.ThrowIfNullOrWhiteSpace(password);

            SubjectAlternativeNameBuilder sanBuilder = new();
            sanBuilder.AddDnsName("subdomain.mydomain.com");
            sanBuilder.AddDnsName("subdomain2.mydomain.com");

            X500DistinguishedName distinguishedName = new($"CN={certificateName}");

            using (RSA rsa = RSA.Create(2048))
            {
                CertificateRequest request = new(
                    distinguishedName,
                    rsa,
                    HashAlgorithmName.SHA256,
                    RSASignaturePadding.Pkcs1);

                request.CertificateExtensions.Add(new X509KeyUsageExtension(
                    X509KeyUsageFlags.DataEncipherment | X509KeyUsageFlags.KeyEncipherment | X509KeyUsageFlags.DigitalSignature,
                    false));

                request.CertificateExtensions.Add(
                   new X509EnhancedKeyUsageExtension([new Oid("1.3.6.1.5.5.7.3.1")], false));

                request.CertificateExtensions.Add(sanBuilder.Build());

                X509Certificate2 certificate = request.CreateSelfSigned(
                    new DateTimeOffset(DateTime.UtcNow.AddDays(-1)),
                    new DateTimeOffset(DateTime.UtcNow.AddYears(32)));

                if (OperatingSystem.IsWindows())
                {
                    certificate.FriendlyName = certificateName;
                }

                byte[] exportedCertificate = certificate.Export(X509ContentType.Pfx, password);

                return new X509Certificate2(
                    exportedCertificate,
                    password,
                    X509KeyStorageFlags.MachineKeySet);
            }
        }
    }