TLS with ASP.Net Core 2.1

[MattComb]

Would it be possible to extend the documentation for ASP.Net Core 2.1 on how to add an encrypted endpoint. I have tried the approaches in the document but does not seem to work with the ASP.Net Core approach.

How can I add an mqtts endpoint listening on 8883?

[fogzot]

I do it as follows on ASP.NET Core 2.1 and it works. I can add this in formation to the wiki if @chkr1011 agrees.

var x509 = new X509Certificate2(Configuration["Mqtt:Certificate"], "");

services.AddHostedMqttServerWithServices(builder => {
    builder
        .WithDefaultEndpoint()
        .WithEncryptedEndpoint()
        .WithEncryptionCertificate(x509.Export(X509ContentType.Pfx));
});

Note that I use a pfx certificate. The way of loading/exporting the certificate showed in the examples never worked for me (and I have still to understand why).

Also, "Mqtt:Certificate" is the configuration key that contains the full path to the pfx certificate file (X509, public key and private key). This isn't optimal, it would be better to access it using a file provider. If you have the certificate and the private key in different files you can always use openssl to join them in a pfx.

[MattComb]

This does not work for me, here is my Configure Services stuff.

       services.Configure<AppSettings>(Configuration.GetSection("AppSettings"));

        var mqttServerOptions = new MqttServerOptionsBuilder()
            .WithConnectionValidator(c =>
                {
                   // some stuff that works
                }
            )
            .WithSubscriptionInterceptor(context =>
                {
                   // some stuff that works
                }
            )
            .WithApplicationMessageInterceptor(context =>
                {
                    // some stuff that works
                }
            )
            .Build();

        services.AddHostedMqttServer(mqttServerOptions);

        //supposed to add tcp support but actually next line does ?!?
        services.AddMqttConnectionHandler();

        //does this add tcp
        services.AddMqttTcpServerAdapter();

        // trying to add tls but doesn't open on 8883
        var x509 = new X509Certificate(@"some cert path here", "password");
        services.AddHostedMqttServerWithServices(builder => {
            builder
                .WithEncryptedEndpoint()
                .WithEncryptedEndpointPort(8883)
                .WithEncryptionCertificate(x509.Export(X509ContentType.Cert));
        });

        services.AddMqttWebSocketServerAdapter();

[MattComb]

Currently I'm able to achieve ws, wss, mqtt but not mqtts (using tcp) It feels like I'm missing an option to add tls to the tcp ?

[fogzot]

The call to services.AddMqttTcpServerAdapter() should be enough.

[MattComb]

unfortunately it is not working

[JanEggers]

services.AddMqttTcpServerAdapter(); is the old api that works on .net sockets

services.AddMqttConnectionHandler(); is the new api for AspnetCore.Connections.Abstractions but it doesnt support tls yet

[dealproc]

Your other option, dependent on how you are deploying, may be to terminate TLS with HAProxy or Nginx, then just have an unecrypted connection from there to the backend service be unencrypted.

[SeppPenner]

When will this be available? I need this as well.

[JanEggers]

this depends on

dotnet/aspnetcore#4623

[SeppPenner]

@JanEggers: Thank you for the information. Hopefully, NetCore 3.0 (Initial release) will be there in August or so...

[SeppPenner]

@JanEggers The issue from AspNetCore is fixed now. Just for information.

[JanEggers]

@SeppPenner I will wait some more until 3.0 is released. and im not sure if we can update because 3.0 does not have .net framework support.

[SeppPenner]

@JanEggers Yeah, that's a good idea.