Egov.Extensions.Configuration 8.0.3

Egov Configuration Extension

This package provides helpers for certificate loading and configuring IOptions<SystemCertificateOptions> in ASP.NET Core 8.0+ applications. This is a base library that serves as a foundation for other NuGet packages in the Egov ecosystem, providing shared certificate management functionality.

Getting Started

Please go through the following instructions to integrate certificate loading into your project.

Prerequisites

Before using this package, ensure you have:

• A valid certificate file (PFX, CER, or PEM format)
• Access to the certificate password if the certificate is password-protected
• For Kubernetes deployments, certificates mounted as secrets with tls.crt and tls.key files

Installing

Install the following package from NuGet

Install-Package Egov.Extensions.Configuration

Then follow the instructions from Configuration and Usage sections below.

Configuration

Add the following configuration section to your appsettings.json:

{
   ...
   "Certificate": {
      "Path": "Files\\Certificates\\yourcertificate.pfx",
      "Password": "yourcertificatepassword"
   }
   ...
}

Path can be:

• A path to a PFX file (requires Password)
• A path to a CER file (for public certificates only)
• A path to a directory containing tls.crt and tls.key files (for Kubernetes mounted secrets)

Password is optional and only required for encrypted PFX files or encrypted PEM private keys.

Usage

Using Dependency Injection (Recommended)

Add the following code snippet to your Program.cs or Startup.ConfigureServices method:

builder.Services.AddSystemCertificate(builder.Configuration.GetSection("Certificate"));

Then inject IOptions<SystemCertificateOptions> or IOptionsSnapshot<SystemCertificateOptions> into your services:

public class MyService
{
    private readonly SystemCertificateOptions _certificateOptions;

    public MyService(IOptions<SystemCertificateOptions> certificateOptions)
    {
        _certificateOptions = certificateOptions.Value;
    }

    public void UseCertificate()
    {
        var certificate = _certificateOptions.Certificate;
        // Use the certificate...
    }
}

Using CertificateLoader Directly

You can also use the CertificateLoader class directly without dependency injection:

Loading a public certificate:

var certificate = CertificateLoader.Public("path/to/certificate.cer");

Loading a private certificate:

var certificate = CertificateLoader.Private("path/to/certificate.pfx", "password");

Loading from Kubernetes mounted secret:

var certificate = CertificateLoader.Private("/etc/ssl/certs", null);

The CertificateLoader automatically handles:

• Loading certificates from PFX files
• Loading certificates from CER files
• Loading certificates from PEM files (including certificate chains)
• Loading certificates from Kubernetes mounted secrets (tls.crt and tls.key)
• Installing intermediate certificates into the certificate store

Supported Certificate Formats

• PFX/PKCS#12: Password-protected certificate with private key
• CER: Public certificate file
• PEM: Certificate chain files (supports tls.crt and tls.key for Kubernetes)

Error Handling

If the certificate cannot be loaded or does not contain a private key (when required), the package will throw an InvalidOperationException with an appropriate error message.