Preserve explicit Kestrel certificate configuration - #20133
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20133Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20133" |
github-actions
Bot
added
the
needs-area-label
Tests selector55 / 99 PR test projects · 4 PR jobs, from 3 changed files. Selected PR test projects (55 / 99)
Selected PR jobs (4)
How these were chosen — grouped by what changed
🔧 show 40
🔧 🧪 📦 affected project 📦 affected project Job reasons
Selection computed for commit |
There was a problem hiding this comment.
🟢 Approval recommended
The implementation matches the agreed behavior and includes focused regression coverage.
Pull request overview
Preserves explicit Kestrel certificate configuration while retaining the default PFX fallback.
Changes:
- Detects explicit Path, KeyPath, or Subject settings case-insensitively.
- Preserves callback ordering and password behavior.
- Adds comprehensive regression coverage.
File summaries
| File | Description |
|---|---|
src/Aspire.Hosting/ProjectResourceBuilderExtensions.cs |
Preserves explicit certificate selections. |
src/Shared/KnownAspNetCoreConfigNames.cs |
Adds KeyPath and Subject constants. |
tests/Aspire.Hosting.Tests/ProjectResourceBuilderExtensionTests.cs |
Covers ordering, modes, casing, and certificate formats. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
e01d15d
into
main
Adds a note to the certificate-configuration doc explaining that WithProjectDefaults preserves an existing explicit Kestrel certificate selection (Path, KeyPath, or Subject) instead of overwriting it with the default PFX mapping, per microsoft/aspire#20133. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Pull request created: #1669
|
|
📝 Documentation has been drafted in microsoft/aspire.dev#1669 targeting Added a note to
Note This draft PR needs human review before merging. |
|
The CI build failed due to test failure(s) that appear unrelated to the PR changes. These may be flaky tests. Suspected flaky test(s):
Suggested actions:
You can re-run the failed jobs from the workflow run page. |
Description
Confirmed root cause
WithHttpsCertificateConfiguration()appends a callback annotation.HttpsCertificateExecutionConfigurationGatherer.GatherAsync()invokes all such callbacks in registration order against one shared environment dictionary.The PEM mapping shown in the issue, also used by YARP, writes:
When registered afterward, the built-in
WithProjectDefaults()callback replacesPathwithctx.PfxPathand updates or removesPassword. It does not remove or otherwise reconcileKeyPath. The result is a mixed PFX/PEM configuration.Kestrel chooses the separate-key loading branch whenever
KeyPathis non-null, including an empty string. That branch rejects the PFX file as the certificate portion of a PEM pair and throwsThe provided key file is missing or invalid.The reproduction uses valid files; the failure is not evidence of a missing or corrupt private key.The default PFX mapping was introduced by [#18481](#18481), commit
16783f098082a62f7b31d06fdca2f6c7d84870c1. Its comments intentionally prefer PFX to avoid platform-specific PEM key-handling differences.Agreed behavior
Keep the existing TLS-endpoint condition.
At certificate callback execution time, check for the resource environment names
Kestrel__Certificates__Default__Path,Kestrel__Certificates__Default__KeyPath, orKestrel__Certificates__Default__Subject.If any selection key is present, leave the entire existing certificate configuration untouched. In particular, do not overwrite
Path, replace or removePassword, or add another representation.Compare the known environment names case-insensitively using the repository's
StringComparisons.EnvironmentVariableNameconvention. Do not change the dictionary's comparer or rewrite the caller's keys.Use key presence, not eager value resolution or file validation. Empty, incomplete, or deferred explicit selections remain the application's responsibility; Kestrel may combine them with other providers.
If no selection key exists, retain the current PFX assignment and password handling exactly. A password by itself, or supporting store settings without
Subject, does not suppress defaults.Preserve callback registration and execution order. Later explicit callbacks retain their current ability to override defaults.
Fixes
#20019
Checklist
<remarks />and<code />elements on your triple slash comments?