title: Unable to use *.pfx certificate with kestrel inside windows service
body: <p>I'm trying to configure my ASP.Net Core 3.1 app using windows service and kestrel.
  So far the app works and starts correctly. Also works correctly in console mode.</p>
  
  <p>However when i add https with my certificate (*.pfx container) things get weird.
  The app works in console made without troubles but fails in service mode with exception:</p>
  
  <pre><code>System.InvalidOperationException: Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date.
  To generate a developer certificate run 'dotnet dev-certs https'. To trust the certificate (Windows and macOS only) run 'dotnet dev-certs https --trust'.
  For more information on configuring HTTPS see https://go.microsoft.com/fwlink/?linkid=848054.
     at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.UseHttps(ListenOptions listenOptions, Action`1 configureOptions)
     at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.UseHttps(ListenOptions listenOptions)
     at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context)
     at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IServerAddressesFeature addresses, KestrelServerOptions serverOptions, ILogger logger, Func`2 createBinding)
     at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken)
     at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)
     at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken)
     at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
     at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
  </code></pre>
  
  <p>Service mode is configured using Microsoft.Extensions.Hosting.WindowsServices. Everything is configured using ConfigureWebHostDefaults() without any specifics regarding certificates or anything. And here is a snippet from appsettings.json:</p>
  
  <pre><code>"Urls": "https://*",
  "Kestrel": {
      "Certificates": {
          "Default": {
              "Path": "full_path_to_my_certificate_container.pfx",
              "Password": "password"
          }
      }
  }
  </code></pre>
  
  <p>Works flawlessly in console mode, certificate is applied correctly, app is accessible. Service mode is used without any configuration changes. Even environment is the same (actually it's not even set, so it's a kind of "production").
  Tried switching service account to my admin account. No difference at all.</p>
  
  <p>What am i missing?</p>
  
  <p><strong>UPDATE_01:</strong></p>
  
  <p>I've changed my config from "*.pfx" certificate to store:</p>
  
  <pre><code>{
      "Kestrel": {
          "Certificates": {
              "Default": {
                  "Location": "LocalMachine",
                  "Store": "Root",
                  "Subject": "MyCertSubjectName"
              }
          }
      }
  }
  </code></pre>
  
  <p>As before this works perfectly in console mode but not in service mode giving the same exception.</p>
  
  <p><strong>UPDATE_02:</strong></p>
  
  <p>Tried the full "Endpoints" block from this link:
  <a href="https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-3.1#listenoptionsusehttps" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel?view=aspnetcore-3.1#listenoptionsusehttps</a></p>
  
  <p>No difference at all. I can see that my config is used correctly because tested it with incorrect values and the app reported them in logs.</p>
  
  <p><strong>UPDATE_03:</strong></p>
  
  <p>Played around with permissions for my certificate in the store. No luck.</p>
  
  <p>I'm lost...</p>