HTTPS, Certificates & Transport Security

var app = builder.Build();
if (!app.Environment.IsDevelopment()) {
    app.UseHsts();
}
app.UseHttpsRedirection();
app.UseAuthorization();
app.MapControllers();
app.Run();

Common follow-ups: What HTTP status code does the redirect use, and why does that choice matter for caching?;What's the difference between HTTPS redirection and HSTS, and why do you need both?

builder.Services.AddHsts(options => {
    options.MaxAge = TimeSpan.FromDays(365);
    options.IncludeSubDomains = true;
    options.Preload = true;
});

var app = builder.Build();
if (!app.Environment.IsDevelopment()) {
    app.UseHsts();  // adds Strict-Transport-Security header to responses
}

Common follow-ups: What is HSTS preloading, and how does submitting to the browser preload list eliminate the first-visit vulnerability window entirely?;What risk does a very long max-age create if you ever need to revert to HTTP temporarily?

// File-based (appsettings.json)
"Kestrel": { "Endpoints": { "Https": { "Url": "https://*:5001", "Certificate": { "Path": "cert.pfx", "Password": "secret" } } } }

// Certificate store by thumbprint (code)
builder.WebHost.ConfigureKestrel(options => {
    options.ListenAnyIP(5001, o => o.UseHttps(StoreName.My, "A1B2C3...", StoreLocation.LocalMachine));
});

// Azure Key Vault integration
builder.Configuration.AddAzureKeyVault(vaultUri, credential);

Common follow-ups: How do you implement zero-downtime certificate rotation without restarting the Kestrel process?;What's the security risk of storing a PFX password directly in appsettings.json versus a secret manager?

# Generate and trust a local development HTTPS certificate
dotnet dev-certs https --trust

# For production, obtain a certificate from a real, trusted CA instead
# (e.g. via Let's Encrypt, DigiCert, or your organization's internal CA)

Common follow-ups: What happens if a dev certificate is accidentally used in a staging or production environment?;How does certificate trust actually work at the browser/OS level (the chain of trust)?

builder.WebHost.ConfigureKestrel(options => {
    options.ConfigureHttpsDefaults(o => o.ClientCertificateMode = ClientCertificateMode.RequireCertificate);
});

builder.Services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
    .AddCertificate(options => {
        options.AllowedCertificateTypes = CertificateTypes.Chained;
        options.Events = new CertificateAuthenticationEvents {
            OnCertificateValidated = context => {
                // custom validation, e.g. checking against an allowlist of thumbprints
                context.Success();
                return Task.CompletedTask;
            }
        };
    });

Common follow-ups: How does mTLS certificate validation and revocation checking work in practice?;What's the operational complexity of distributing and rotating client certificates to multiple partner organizations?

// Example of certificate pinning logic (generally NOT recommended for typical scenarios)
var handler = new HttpClientHandler {
    ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => {
        var expectedThumbprint = "AABBCCDD...";
        return cert?.GetCertHashString() == expectedThumbprint;
    }
};

Common follow-ups: What are safer alternatives to full certificate pinning that still improve on default CA trust, like public key pinning with backup pins?;In what specific scenarios (like a fixed-purpose IoT device) might pinning's trade-offs actually be worthwhile?

// Program.cs -- using LettuceEncrypt for automatic Let's Encrypt certificate management
builder.Services.AddLettuceEncrypt(options => {
    options.DomainNames = new[] { "api.example.com" };
    options.EmailAddress = "admin@example.com";
});

// LettuceEncrypt handles the ACME challenge, issuance, and automatic renewal transparently,
// hot-swapping the certificate into Kestrel without a restart

Common follow-ups: What is the ACME HTTP-01 challenge, and what network access does it require during the renewal process?;How does this compare to relying on a managed platform's (like Azure App Service's) built-in automatic HTTPS management?

builder.WebHost.ConfigureKestrel(options => {
    options.ConfigureHttpsDefaults(o => {
        o.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13;
    });
});

Common follow-ups: How would you test which TLS versions and cipher suites a deployed endpoint actually supports (like using an external SSL testing tool)?;What legacy client compatibility trade-off do you make by disabling TLS 1.0/1.1 entirely?

builder.WebHost.ConfigureKestrel(options => {
    options.ConfigureHttpsDefaults(httpsOptions => {
        httpsOptions.ServerCertificateSelector = (connectionContext, hostName) => {
            return _certificateStore.GetCertificateForHostname(hostName);
        };
    });
});

Common follow-ups: How do you handle a client that doesn't support SNI (very old browsers/clients)?;How would you efficiently cache and refresh certificates in the ServerCertificateSelector delegate to avoid expensive lookups on every handshake?

// DANGEROUS -- disables certificate validation entirely, should never reach production
var handler = new HttpClientHandler {
    ServerCertificateCustomValidationCallback = (msg, cert, chain, errors) => true  // accepts ANY certificate
};

// SAFER -- validate against a specific known issue rather than disabling entirely
var saferHandler = new HttpClientHandler {
    ServerCertificateCustomValidationCallback = (msg, cert, chain, errors) => {
        return errors == SslPolicyErrors.None || IsKnownAcceptableException(cert);
    }
};

Common follow-ups: What's a safer, narrower workaround for a legitimate development-only self-signed certificate issue?;How would you detect if certificate validation has been inadvertently disabled somewhere in a large codebase?