title: HTTPS not working with Kestrel 3.2.187/ASPNET Core 2.1.5 running on the Service Fabric with a custom domain
body: <p>We are running a Service Fabric application on our remote dev cluster. It consists of several stateful and stateless services and is fronted by several front-end APIs running on Kestrel.</p>
  
  <p>Until now, since it was not used for production, Kestrel was configured to use a self-signed certificate, which was also used for the reverse proxy and the cluster itself and the service was running directly on the default domain provided by Azure, <code>&lt;app&gt;.&lt;region&gt;.cloudapp.azure.com</code>.</p>
  
  <p>We are now getting to the point in development where the self-signed certificate errors are becoming problematic, with third party callbacks rejecting the connection, so it was seen as the time to start using a proper domain and certificate for it.</p>
  
  <p>So far, I have done the following:</p>
  
  <ul>
  <li>Added an A record for <code>devcluster.somexampledomain.com</code> -> our public IP for the service.</li>
  <li>Created a Wildcard Azure Application certificate for <code>*.someexampledomain.com</code>.</li>
  <li>Imported the certificate to Azure Key Vault.</li>
  <li>Bound the certificate to the Vault Secrets of the cluster, pulling the certificate to <code>Cert:/LocalMachine/My/</code></li>
  <li>Modified the application config to use this certificate when initialising Kestrel and verified that it is found when it is initialising.
  
  <ul>
  <li>Have tried with and without <code>UseHsts()</code> and <code>UseHttpsRedirection()</code></li>
  <li>Kestrel is configured with <code>Listen(IPAddress.IPv6Any, endpoint.Port, ...)</code> and <code>UseHttps(X509Certificate2)</code> on the options object.</li>
  <li><code>UseUrls(string)</code> is used with the default Url, which is <code>https://+:&lt;port&gt;</code> but tried manually adding <code>https://*:&lt;port&gt;</code> and even the actual hostname itself.</li>
  </ul></li>
  </ul>
  
  <p>No matter what I have tried, no HTTPS connection can be established to the server. Trying the endpoints of the other staging servers that still use the old certificate, it works as expected.</p>
  
  <p>Using <code>openssl s_client -connect devcluster.someexampledomain.com:&lt;port&gt; -prexit</code>, I get:</p>
  
  <pre><code>---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  </code></pre>
  
  <p>There are no errors or exceptions being logged on ETW, everything seems to be in order. I suspect that this might have something to do with the CN of the certificate but I have run out of ideas to try and find out what is going on and how to fix it.</p>
  
  <p>Been trying to look into this using Fiddler and I am not getting much out of it, the session just ends with <code>fiddler.network.https&gt; HTTPS handshake to &lt;myhost&gt; (for #191) failed. System.IO.IOException Authentication failed because the remote party has closed the transport stream.
  </code></p>
  
  <p>Does anybody know how to add some logging on the Kestrel side? I don't think installing Fiddler on the Azure VMs running my cluster is a viable solution.</p>