title: OnCertificateValidated not running - Self-Signed Certificate Client Authentication - ASP.NET Core and Kestrel
body: <p>I would like to authenticate clients connecting to my ASP.NET Core Web API (.NET 5) running on Kestrel using certificate-based authentication.</p>
  <p>In my <code>Startup.cs</code> I have the following in <code>ConfigureServices</code>:</p>
  <pre class="lang-cs prettyprint-override"><code>services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
      .AddCertificate(options =&gt;
      {
          options.AllowedCertificateTypes = CertificateTypes.All;
          options.Events = new CertificateAuthenticationEvents
          {
              OnCertificateValidated = context =&gt;
              {
                  // More code to verify certificates
              },
              OnAuthenticationFailed = context =&gt;
              {
                  // More code
              }
          };
      });
  
  // Other services
  </code></pre>
  <p>And in <code>Configure</code>:</p>
  <pre><code>app.UseHttpsRedirection();
  
  app.UseRouting();
  
  app.UseAuthentication();
  
  app.UseEndpoints(endpoints =&gt;
  {
      // Endpoints
  });
  </code></pre>
  <p>And in <code>Program.cs</code> I have included:</p>
  <pre class="lang-cs prettyprint-override"><code>webBuilder.ConfigureKestrel(o =&gt;
  {
      o.ConfigureHttpsDefaults(o =&gt;
          o.ClientCertificateMode = ClientCertificateMode.RequireCertificate);
  });
  </code></pre>
  <p>If I connect to the API in a browser, it prompts me for a certificate, but after I select a certificate, neither the <code>OnCertificateValidated</code> nor the <code>OnAuthenticationFailed</code> events are triggered. After some further testing, I realized that the entire options configuration delegate inside the <code>AddCertificate</code> call in <code>Startup.cs</code> never runs. This makes me think I am missing some kind of configuration for Kestrel, but I do not know what that is. As a note, my Web API does NOT use IIS hosting. What else do I need to do to use self-signed certificate-based authentication?</p>
  <p>The code I have so far is based on the instructions found in the documentation here: <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/certauth?view=aspnetcore-5.0" rel="noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/authentication/certauth?view=aspnetcore-5.0</a></p>