KeyVault's Kestrel Secure HTTPS X509 Certificate

Dr. Skizzo

I'd like to secure my API with a pfx certificate I store in KeyVault, but for some reason this doesn't seem to work the way I expect. If I have a certificate installed on my computer it works fine. I'm wondering if it's possible to store the certificate in KeyVault and then secure it that way instead of looking it up in the certificate store.

The scenario is that I have a .NET Core Web API that talks to KeyVault. This KeyVault contains my PFX certificate and when I upload it prompts you for a password. So at this point everything seems to be fine.

I have the following code to retrieve and apply the certificate:

            var client = new KeyVaultClient(new KeyVaultCredential(GetToken));
            var cert = client.GetCertificateAsync("https://somekeyvaultsomewhere.vault.azure.net/", "my_tls_cert").Result;
            var certificate = new X509Certificate2(cert.Cer);

            var host = new WebHostBuilder()
                .UseKestrel(options =>
                {
                    const int PortNumber = 5001;
                    options.Listen(
                        new IPEndPoint(IPAddress.Any, PortNumber),
                        listenOptions =>
                        {
                            listenOptions.KestrelServerOptions.AddServerHeader = false;
                            listenOptions.UseHttps(certificate);
                        });
                })
                .CaptureStartupErrors(true)
                .UseStartup<Startup>()
                .Build();

            host.Run();

I want to be able to access my API via httpsand on port 5001. Instead, I get no response (can't access the site).

Everything seems to be running but can't hit anything.

enter image description here

is it possible?

Packages consumed:

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.All" Version="2.0.6" />
    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel" Version="2.1.3" />
    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Https" Version="2.1.3" />
    <PackageReference Include="Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions" Version="2.1.3" />
  </ItemGroup>
Matt Small

I think it's because the certificate you downloaded is not the full certificate, but just the public key. The lack of a private key will prevent the SSL handshake from completing. You can download the entire certificate as a password, then convert the password to an X509Certificate2 object. I explain it in this blog post:

https://azidentity.azurewebsites.net/post/2018/07/03/azure-key-vault-certificates-are-secrets

Related

KeyVault's Kestrel Secure HTTPS X509 Certificate

Dr. Skizzo I'd like to secure my API with a pfx certificate I store in KeyVault, but for some reason this doesn't seem to work the way I expect. If I have a certificate installed on my computer it works fine. I'm wondering if it's possible to store the certifi

KeyVault's Kestrel Secure HTTPS X509 Certificate

Dr. Skizzo I'd like to secure my API with a pfx certificate I store in KeyVault, but for some reason this doesn't seem to work the way I expect. If I have a certificate installed on my computer it works fine. I'm wondering if it's possible to store the certifi

Secure connection using x509 certificate

Zogby I created the CA certificate with the secret private key I generated and added it to each host's Trusted Root Certification Authorities. I then receive a certificate request from that host and sign it with my private key, defining an expiration date. And

Secure connection using x509 certificate

Zogby I created the CA certificate with the secret private key I generated and added it to each host's Trusted Root Certification Authorities. I then receive a certificate request from that host and sign it with my private key, defining an expiration date. And

Load X509 certificate from Azure KeyVault

tom We host a web application in Azure that loads certificates from KeyVault for encryption and authentication with other services. After reading the value from KeyVault, we will create the certificate as follows: return new X509Certificate2(Convert.FromBase64

Load X509 certificate from Azure KeyVault

tom We host a web application in Azure that loads certificates from KeyVault for encryption and authentication with other services. After reading the value from KeyVault, we will create the certificate as follows: return new X509Certificate2(Convert.FromBase64

Load X509 certificate from Azure KeyVault

tom We host a web application in Azure that loads certificates from KeyVault for encryption and authentication with other services. After reading the value from KeyVault, we will create the certificate as follows: return new X509Certificate2(Convert.FromBase64

Load X509 certificate from Azure KeyVault

tom We host a web application in Azure that loads certificates from KeyVault for encryption and authentication with other services. After reading the value from KeyVault, we will create the certificate as follows: return new X509Certificate2(Convert.FromBase64

Load X509 certificate from Azure KeyVault

tom We host a web application in Azure that loads certificates from KeyVault for encryption and authentication with other services. After reading the value from KeyVault, we will create the certificate as follows: return new X509Certificate2(Convert.FromBase64

Load X509 certificate from Azure KeyVault

tom We host a web application in Azure that loads certificates from KeyVault for encryption and authentication with other services. After reading the value from KeyVault, we will create the certificate as follows: return new X509Certificate2(Convert.FromBase64

Load X509 certificate from Azure KeyVault

tom We host a web application in Azure that loads certificates from KeyVault for encryption and authentication with other services. After reading the value from KeyVault, we will create the certificate as follows: return new X509Certificate2(Convert.FromBase64

Load X509 certificate from Azure KeyVault

tom We host a web application in Azure that loads certificates from KeyVault for encryption and authentication with other services. After reading the value from KeyVault, we will create the certificate as follows: return new X509Certificate2(Convert.FromBase64

Extract client X509 certificate from secure Websocket connection

Guillaume Pansier I want to create certificate based authentication on top of websocket communication. So I created a websocket serverEndpoint and set up SSL for client authentication with the help of jetty like this: Server server = new Server(); //Create SS

Extract client X509 certificate from secure Websocket connection

Guillaume Pansier I want to create certificate based authentication on top of websocket communication. So I created a websocket serverEndpoint and set up SSL for client authentication with the help of jetty like this: Server server = new Server(); //Create SS

Get X509 certificate with private key from Azure Keyvault c#

Damian Payet I'm currently working on an authentication server developed in C# that is hosted on an azure function app and I use a KeyVault to store my secrets. My problem is as follows, in my keystore, I store a certificate (certificate + private key), when I

Secure production SF cluster with self-signed X509 certificate

Brett Robbie I'm working on ways to determine the details of securing our SF cluster. I found that the documentation mentions in many places not to use self-signed certificates for production workloads. But there is nowhere to explain why. Can anyone on the SF

Secure production SF cluster with self-signed X509 certificate

Brett Robbie I'm working on ways to determine the details of securing our SF cluster. I found that the documentation mentions in many places not to use self-signed certificates for production workloads. But there is nowhere to explain why. Can anyone on the SF

Secure production SF cluster with self-signed X509 certificate

Brett Robi I'm working on ways to determine the details of securing our SF cluster. I found that the documentation mentions in many places not to use self-signed certificates for production workloads. But there is nowhere to explain why. Can anyone on the SF t

Secure production SF cluster with self-signed X509 certificate

Brett Robbie I'm working on ways to determine the details of securing our SF cluster. I found that the documentation mentions in many places not to use self-signed certificates for production workloads. But there is nowhere to explain why. Can anyone on the SF

Secure production SF cluster with self-signed X509 certificate

Brett Robbie I'm working on ways to determine the details of securing our SF cluster. I found that the documentation mentions in many places not to use self-signed certificates for production workloads. But there is nowhere to explain why. Can anyone on the SF

https with manual ssl certificate and kestrel useHttps

ScumbagNiad I'm trying to setup a simple API via https and .Net Web API. public class Program { public static void Main(string[] args) { BuildWebHost(args).Run(); } public static IWebHost BuildWebHost(string[] args) => WebHost.

https with manual ssl certificate and kestrel useHttps

ScumbagNiad I'm trying to setup a simple API via https and .Net Web API. public class Program { public static void Main(string[] args) { BuildWebHost(args).Run(); } public static IWebHost BuildWebHost(string[] args) => WebHost.

https with manual ssl certificate and kestrel useHttps

ScumbagNiad I'm trying to setup a simple API via https and .Net Web API. public class Program { public static void Main(string[] args) { BuildWebHost(args).Run(); } public static IWebHost BuildWebHost(string[] args) => WebHost.