2.1 Improvements to HTTPS

[Rick-Anderson]

See dotnet/aspnetcore#2308
javiercn to review.

• provide URL for .NET Core CLI fwlink that tells how to trust cert, how to set up HTTPS go here See 2:40 in video
• Add HttpsRedirection and Hsts middleware documentation #4568
• Add section on dotnet dev-certs https , more detail below
• Need at least a H2 in Enforcing HTTPS in an ASP.NET Core app for Certificate missing error . Someone in the PU requested this, they have a fwlink that will point to this. I think this was more aimed at server and not dev.
• We don't recommend using RequireHttpsAttribute and I'm going to suggest deprecating it. Use 2.1 templates approach which uses app.RedirectToHttps
  See also New kestrel configuration & related APIs #5056 and https://blogs.msdn.microsoft.com/webdev/2018/02/02/asp-net-core-2-1-roadmap/#security

[guardrex]

For discussion/consideration:

Improve 'how to download' for running with HTTPS

https://docs.microsoft.com/aspnet/core/tutorials/index#how-to-download-a-sample

Possibly update section heading: How to download and run a sample

Per @scottaddie:

You should just need to run:

dotnet dev-certs https --trust

See the instructions here:

https://blogs.msdn.microsoft.com/webdev/2018/02/27/asp-net-core-2-1-https-improvements/

May also need the tool installed ...

dotnet install tool dotnet-dev-certs -g --version 2.1.0

Change "how to download" link text to "how to download and run" across the repo.

Also note that FF has required a manual step to approve the use of untrusted certs in the past.

[guardrex]

Since the Enforce HTTPS topic is called out for the content's location, this one looks related: Add HttpsRedirection and Hsts middleware documentation #4568