Listen on https by default if the cert is present

Author: Tratcher

src/Kestrel.Core/CoreStrings.resx

@@ -465,4 +465,7 @@
   <data name="UnableToConfigureHttpsBindings" xml:space="preserve">
     <value>Unable to configure default https bindings because no IDefaultHttpsProvider service was provided.</value>
   </data>
+  <data name="BindingToDefaultAddresses" xml:space="preserve">
+    <value>No listening endpoints were configured. Binding to {address0} and {address1} by default.</value>
+  </data>
 </root>

src/Kestrel.Core/Internal/AddressBinder.cs

@@ -6,6 +6,7 @@
 using System.IO;
 using System.Linq;
 using System.Net;
+using System.Security.Cryptography.X509Certificates;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting.Server.Features;
@@ -163,12 +164,33 @@ private class DefaultAddressStrategy : IStrategy
         {
             public async Task BindAsync(AddressBindContext context)
             {
-                context.Logger.LogDebug(CoreStrings.BindingToDefaultAddress, Constants.DefaultServerAddress);
-
                 var options = ParseAddress(Constants.DefaultServerAddress, out var https);
                 options.KestrelServerOptions = context.ServerOptions;
                 context.ServerOptions.EndpointDefaults(options);
                 await options.BindAsync(context).ConfigureAwait(false);
+
+                // Conditional https default, only if a cert is available
+                options = ParseAddress(Constants.DefaultServerHttpsAddress, out https);
+                options.KestrelServerOptions = context.ServerOptions;
+                context.ServerOptions.EndpointDefaults(options);
+
+                if (!options.ConnectionAdapters.Any(f => f.IsHttps))
+                {
+                    try
+                    {
+                        context.DefaultHttpsProvider.ConfigureHttps(options);
+                    }
+                    catch (Exception)
+                    {
+                        // No default cert is available
+                        context.Logger.LogDebug(CoreStrings.BindingToDefaultAddress, Constants.DefaultServerAddress);
+                        return;
+                    }
+                }
+
+                context.Logger.LogDebug(CoreStrings.BindingToDefaultAddresses,
+                    Constants.DefaultServerAddress, Constants.DefaultServerHttpsAddress);
+                await options.BindAsync(context).ConfigureAwait(false);
             }
         }
 
@@ -260,6 +282,8 @@ private UnconfiguredDefaultHttpsProvider()
             {
             }
 
+            public X509Certificate2 Certificate => null;
+
             public void ConfigureHttps(ListenOptions listenOptions)
             {
                 // We have to throw here. If this is called, it's because the user asked for "https" binding but for some

src/Kestrel.Core/Internal/IDefaultHttpsProvider.cs

@@ -1,10 +1,21 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+using System.Security.Cryptography.X509Certificates;
+
 namespace Microsoft.AspNetCore.Server.Kestrel.Core.Internal
 {
     public interface IDefaultHttpsProvider
     {
+        /// <summary>
+        /// Returns the default certificate, if available, otherwise null.
+        /// </summary>
+        X509Certificate2 Certificate { get; }
+
+        /// <summary>
+        /// Adds the https connection adapter using the default certificate. This throws if the certificate is not available.
+        /// </summary>
+        /// <param name="listenOptions"></param>
         void ConfigureHttps(ListenOptions listenOptions);
     }
 }

src/Kestrel.Core/Internal/Infrastructure/Constants.cs

@@ -13,6 +13,7 @@ internal static class Constants
         /// The IPEndPoint Kestrel will bind to if nothing else is specified.
         /// </summary>
         public static readonly string DefaultServerAddress = "http://localhost:5000";
+        public static readonly string DefaultServerHttpsAddress = "https://localhost:5001";
 
         /// <summary>
         /// Prefix of host name used to specify Unix sockets in the configuration.

src/Kestrel.Core/Properties/CoreStrings.Designer.cs

@@ -23,25 +23,37 @@ public DefaultHttpsProvider(ILogger<DefaultHttpsProvider> logger)
             _logger = logger;
         }
 
+        public X509Certificate2 Certificate => GetDefaultCert();
+
         public void ConfigureHttps(ListenOptions listenOptions)
         {
-            var certificate = GetDefaultCert();
+            listenOptions.UseHttps(options =>
+            {
+                // ConfigureHttpsDefaults may have set the default cert.
+                if (options.ServerCertificate == null)
+                {
+                    options.ServerCertificate = GetDefaultCert();
+                    if (options.ServerCertificate == null)
+                    {
+                        throw new InvalidOperationException(KestrelStrings.HttpsUrlProvidedButNoDevelopmentCertificateFound);
+                    }
+                }
+            });
+        }
+
+        private X509Certificate2 GetDefaultCert()
+        {
+            var certificate = _certificateManager.ListCertificates(CertificatePurpose.HTTPS, StoreName.My, StoreLocation.CurrentUser, isValid: true)
+                .FirstOrDefault();
             if (certificate != null)
             {
                 _logger.LocatedDevelopmentCertificate(certificate);
-                listenOptions.UseHttps(certificate);
             }
             else
             {
                 _logger.UnableToLocateDevelopmentCertificate();
-                throw new InvalidOperationException(KestrelStrings.HttpsUrlProvidedButNoDevelopmentCertificateFound);
             }
-        }
-
-        internal static X509Certificate2 GetDefaultCert()
-        {
-            return _certificateManager.ListCertificates(CertificatePurpose.HTTPS, StoreName.My, StoreLocation.CurrentUser, isValid: true)
-                .FirstOrDefault();
+            return certificate;
         }
     }
 }

src/Kestrel/Internal/DefaultHttpsProvider.cs

@@ -79,11 +79,13 @@ public void Build()
                     }
                     else if (certInfo.IsStoreCert)
                     {
+                        // TODO: Throw if the cert cannot be loaded, FileCert does.
                         httpsOptions.ServerCertificate = LoadFromStoreCert(certInfo);
                     }
                     else if (httpsOptions.ServerCertificate == null)
                     {
-                        httpsOptions.ServerCertificate = DefaultHttpsProvider.GetDefaultCert();
+                        var provider = Options.ApplicationServices.GetRequiredService<IDefaultHttpsProvider>();
+                        httpsOptions.ServerCertificate = provider.Certificate; // May be null
                     }
                 }