Add support for PEM format SSL certificates

[Praveen-Rai]

Presently, Kestrel configuration supports only the PKCS12 ( *.pfx ) format certificates. Whereas, PEM seems to be much more widely used format ( Public and Private keys are stored in two different files ) and most often one needs to convert the certificate format using OpenSSL before they can be used with Kestrel.

Referring to : https://github.com/dotnet/corefx/issues/32367#issuecomment-423671246
It looks like that the core already has api's to load public and private keys from two different files. Can we leverage them and add the support for the PEM certificate formats ?

[Tratcher]

It looks like that the core already has api's to load public and private keys from two different files. Can we leverage them and add the support for the PEM certificate formats ?

Which APIs does core have for this? Do you end up with one or two X509Certificate2 instances?

Note Kestrel uses SslStream for all of it's TLS negotiation, we're constrained by what it can do.

[Drawaes]

SslStream doesn't care how you get your x509Certificate2 generally. As for the PEM issue not sure if you can construct the instance from two separate files but you can in theory (eg I modified core tondo it with openssl).

If it can't be done today it's most likely an ask for an API extension in .net corefx that is needed.

[Drawaes]

I will test it tonight because I had an example for Linux of this working.

[Praveen-Rai]

@Drawaes Any updates ??

[muratg]

@Praveen-Rai I recommend filing a bug on dotnet/corefx repo to track SSL format support ask. It's on their side to implement this.

[Praveen-Rai]

@muratg , @Tratcher I already created an issue earlier dotnet/corefx#32367 . The comments on the issue seems to convey that there's already some ground work done in Core and Kestrel needs to implement the changes to be able to support the PEM format. CopyWithPrivateKey() was cited in one of the comments. Request you to please review the issue once and correct me if i got it wrong and i will raise another issue specific to PEM format Support.

For your reference the API doc for CopyWithPrivateKey() :

• RSACertificateExtensions.CopyWithPrivateKey

• DSACertificateExtensions.CopyWithPrivateKey

[Tratcher]

Ah, since the X509Certificates2 APIs already exists then you can already load the certificates, combine them, and pass them to Kestrel.

What kind of additional Kestrel API do you anticipate is needed here? An overload of UseHttps that accepted two certificate paths? Additional config file parameters for specifying the second cert? Show us how you want to use it.

[Praveen-Rai]

@Tratcher Referring to Kestrel Listen Options

1. I couldn't find any Overload to UseHttps() which takes Public Key File (.crt) and Private Key File(.key).
2. Looking the sample configuration in the same article :

`

"HttpsInlineCertFile": {

  "Url": "https://localhost:5001",

  "Certificate": {

    "Path": "<path to .pfx file>",

    "Password": "<certificate password>"

  },

"HttpsInlineCertStore": {

  "Url": "https://localhost:5002",

  "Certificate": {

    "Subject": "<subject; required>",

    "Store": "<certificate store; defaults to My>",

    "Location": "<location; defaults to CurrentUser>",

    "AllowInvalid": "<true or false; defaults to false>"

  }

`

Quoting the statement below the sample :

The Certificate section supports both Path–Password and Subject–Store certificates.

All i am looking forward is something as example below :

`

"HttpsPEMCertificate": {

  "Url": "https://localhost:5002",

  "Certificate": {

    "PublicKeyFile": "<filepath to *.crt>",

    "PrivateKeyFile": "<filepath to *.key>",

  }

`

Presently most of the certificate providers issue a pair of *.crt and *.key file ( as far as my knowledge goes ). But as Kestrel configuration needs *.pfx file, one needs to combine *.crt & *.key using OpenSSL to generate *.pfx file.

[muratg]

@Tratcher do we need to add a sample/doc or are we missing a necessary API?

[Tratcher]

Both. Anything Kestrel can do with certs can also be done in app code (needs a sample), but Kestrel could also provide more first class APIs and config for this scenario.

[Praveen-Rai]

@Tratcher Any timelines for this issue ??

[Tratcher]

@Praveen-Rai no, we're just starting our 3.0 planning so that's the earliest release that could include something like this.

Putting together a sample of how devs would do this in Program.Main would be a good place to start. Kestrel's wouldn't be doing anything special here, only integrating and simplifying what devs can already do themselves.

https://github.com/dotnet/corefx/issues/32367#issuecomment-423671246 mentions the functionality being available in the corefx master branch. That also corresponds to the 3.0 release. That might be challenging to work with prior to the first preview release, you might need to revisit this issue after that.

[Praveen-Rai]

Ah, since the X509Certificates2 APIs already exists then you can already load the certificates, combine them, and pass them to Kestrel.

Putting together a sample of how devs would do this in Program.Main would be a good place to start.

@guardrex , @shirhatti Can we please have a document on how to read and load CRT format certificates using X509Certificates2 APIs and pass them to Kestrel ?