Eigenverft.WebLib.Kestrel.Sni 1.0.0.5

Eigenverft.WebLib.Kestrel.Sni

Configuration-driven Kestrel HTTP/HTTPS listeners with SNI certificate selection and controlled certificate recovery.

✨ At a glance

📦 Installation

dotnet add package Eigenverft.WebLib.Kestrel.Sni

🚀 Quick start

Add configuration sources before building the app, then call the extension once:

using Eigenverft.WebLib.Kestrel.Sni;

builder.WebHost.ConfigureKestrelSniFromConfiguration();

A minimal configuration shape is:

{
  "KestrelSettings": {
    "HTTP_PORT": 8080,
    "HTTPS_PORT": 8443,
    "ListenScope": "Localhost",
    "Protocols": "Http1AndHttp2",
    "PreferLongestSuffixMatch": true,
    "TlsProtocolPolicy": "Default"
  },
  "CertificatesDirectory": "certs",
  "CertificatesMappingSettings": [
    {
      "SNI": "example.com",
      "FileName": "example.com.pfx",
      "Password": "load-from-protected-configuration"
    }
  ]
}

Listener and certificate behavior

The KestrelSettings section is required (override its path with kestrelSettingsSectionPath). At least one listener must be enabled; HTTPS requires a valid certificate map even for HTTP-only listener mode. Listener ports, scope, protocols, TLS policy, match preference, and certificate directory are read at startup and require a host restart to change. TlsProtocolPolicy applies only when HTTPS is enabled. The certificate directory defaults to certs below the content root; an override takes precedence, and relative paths resolve against that root.

CertificatesMappingSettings maps an SNI suffix to a FileName and optional Password. The longest matching DNS suffix is preferred by default, with a DNS-label boundary; if no SNI or suffix matches, the first configured mapping is the fallback. Keep certificate passwords in protected configuration rather than committed plaintext. Certificate file paths must remain inside the configured certificate directory.

Only certificate mappings are hot-reloadable, and the configuration provider must emit reload notifications. A failed reload retains the last-known-good generation. Recovery defaults to None: the configured PFX must load, contain a private key, and be currently valid; an unusable initial certificate fails startup. PreserveExisting can generate a memory-only self-signed fallback without replacing the file. ReplaceExpired manages missing or expired PFX files; ReplaceAnyUnusable is intended only for fully application-managed files. Additional self-signed DNS/IP names apply only when recovery generates a certificate.

🎯 Target frameworks

Targets net8.0 and net10.0; .NET 9 can consume the compatible net8.0 asset.

🔗 Project links

• Repository
• Solution and tests
• Project source
• NuGet package

📄 License

MIT; see the repository license.