Kestrel is a web server that comes included with ASP.net Core new-project templates as a default. Kestrel represents a cross-platform web server based on libuv\u2014a cross-platform asynchronous I\/O library.<\/p>\n
Kestrel is relatively new, as October 27, 2016, Microsoft was still suggesting you use IIS, Nginx or Apache as a reverse proxy server for edge deployments as a result of security concerns:<\/p>\n
Kestrel is relatively new and does not yet have a full complement of defenses against attacks. This includes but isn’t limited to appropriate timeouts, size limits, and concurrent connection limits. For more information about when to use Kestrel with a reverse proxy, see Kestrel<\/strong><\/p><\/blockquote>\n
Today we\u2019re going to discuss how to implement SSL on Kestrel and enable HTTPS connections, adding a much needed layer of security to the fledgling server.<\/p>\n
To implement SSL and configure the server for HTTPS, you\u2019ll need to start by acquiring an SSL certificate. This a simple process, you\u2019ll just need to:<\/p>\n
\n
- Select and purchase an SSL certificate<\/li>\n
- Generate a CSR and a public\/private key-pair<\/li>\n
- Send the public key and your CSR to the Certificate Authority<\/li>\n
- Undergo validation<\/li>\n
- Receive your SSL Certificate and any intermediates that accompany it<\/li>\n<\/ol>\n<\/span><\/span>\n
After you\u2019ve done all this, make sure you have provided a friendly name for the certificate and store, and have the pfx file handy.<\/p>\n
Modify the project.json file to add a reference to Kestrel.https nuget package.<\/p>\n
“dependencies”: {
\n“Microsoft.AspNet.Server.Kestrel”: “1.0.0-rc1-final”,
\n“Microsoft.AspNet.IISPlatformHandler”: “1.0.0-rc1-final”,
\n“Microsoft.AspNet.Diagnostics”: “1.0.0-rc1-final”,
\n“Microsoft.AspNet.Mvc”: “6.0.0-rc1-final”,
\n“Microsoft.Extensions.Logging.Console”: “1.0.0-rc1-final”,
\n“Microsoft.AspNet.Server.Kestrel.Https”: “1.0.0-rc1-final”
\n}<\/p>\nAfter that, you\u2019ll need to modify the startup file, configure() method to use the certificate.<\/p>\n
public void Configure(IApplicationBuilder app,
\nIHostingEnvironment env,
\nIApplicationEnvironment appEnv,
\nILoggerFactory loggerFactory)
\n{
\nloggerFactory.AddConsole();
\nvar pfxFile = Path.Combine(appEnv.ApplicationBasePath, “Sample.pfx”);
\nX509Certificate2 certificate = new X509Certificate2(pfxFile, “Password”);
\napp.Use(ChangeContextToHttps);
\napp.UseKestrelHttps(certificate);
\napp.UseDeveloperExceptionPage();
\napp.UseMvcWithDefaultRoute();
\n}<\/p>\nNow, make sure not to hard code your certificate password, use the secrets API instead.<\/p>\n