title: Asp.Net-Core Application in docker over https
body: <p>We've recently run into the requirement to serve our containerized application over https in docker.</p>
  
  <p><a href="https://docs.microsoft.com/en-us/aspnet/core/security/docker-https?view=aspnetcore-3.1" rel="noreferrer">Following Microsoft's guide</a> I was able to reach the container application from my host machine and everything worked fine, including SSL.</p>
  
  <p>The problem happens when trying to communicate with the application from inside the docker environment. The same container/other containers run into the issue of not being able to verify the certificate when trying to communicate with the application.
  This behavior can be observed in the linked example application from Microsoft as well. Trying to curl the website from within the container (<code>curl https://localhost</code>) always yields: <code>curl: (60) SSL certificate problem: unable to get local issuer certificate</code>
  This isn't a problem specific to curl, as calls utilizing <code>HttpClient</code> also return SSL related errors.</p>
  
  <p>Figuring it would be like on windows, where you simply have to add the Self-Signed .pfx to your cert-store, I created a self-signed certificate using 
  <code>New-SelfSignedCertificate -DnsName "localhost", "dockerDnsName", "127.0.0.1" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date("2050-01-01"))</code>
  I need both the localhost and dockerDnsName in my cert's SubjectAlternateName because containers from within the docker network will talk to the container using that name. 
  I then added the certificate to my host's trusted root CAs.</p>
  
  <p>I followed Microsoft's guide of adding the pfx to the container, setting the environment variables for Kestrel to the relevant values (<code>ASPNETCORE_Kestrel__Certificates__Default__Path</code> and <code>ASPNETCORE_Kestrel__Certificates__Default__Password</code>) and booted the container.</p>
  
  <p>Accessing the container via the browser from the host still worked. Accessing the website from within the container yielded the SSL error again.
  I then converted the .pfx to .crt inside the container via <code>openssl pkcs12 -in myRootCA.pfx -clcerts -nokeys -out myRootCA.crt</code>, added the resulting .crt to <code>/usr/local/share/ca-certificates/</code> and ran <code>update-ca-certificates</code>.
  To my understanding that should have fixed it, but I still get the same SSL related errors.</p>
  
  <p>Edit: No idea if it makes any difference, but this particular application is served (docker-)internally at port 5000 and the port-mapping to the host is 5000:5000.</p>