ASP.NET Core Web API production HTTPS certificate 101 Level question

Question

Hi, I've created a ASP.NET Core Web API service (using dotnet 6) that pulls data out of a public transport api and updates various internal APIs with that data. The system it runs on is public facing.

The production system is a Windows 2022 server and the app will run as a windows service.

I tried to run the app on the system, but got the error:

general exception: Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date.

I'm used to seeing this on a dev machine and can fix it with:

dotnet dev-certs https --trust

As I understand it - this is just a development process and shouldn't be done on a production public facing system.

Q1: Presumably it can be fixed by generating an HTTPS certificate from one of the many online certificate providers? (Q1a how would that be installed? Q1b and would it work for a Windows Service?)

Q2: Would I need to change anything in the boilerplate code generated by Visual Studio? MSDN seems to imply I need to change it with:

builder.Services.Configure<KestrelServerOptions>(options => {
    options.ConfigureHttpsDefaults(options =>
        options.ClientCertificateMode = ClientCertificateMode.RequireCertificate);
});

Many thanks.

Answer 1

you are confusing client certificates, which are used for client authentication over a ssl connection and ssl server certificates. see:

https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel/endpoints?view=aspnetcore-7.0

once you purchase your x509 certificate, you should get a .pfx file and password

try:

builder.WebHost.ConfigureKestrel(serverOptions =>
{
    serverOptions.ConfigureEndpointDefaults(listenOptions =>
    {
        listenOptions.UseHttps(certFileName, password);
    });
});