How to install .pfx certificate in windows docker image

user_4523568 0
Viewed 5576

I have a .Net Core API which uses identityServer 4, I am trying to run the API into the Docker Compose (Windows Container) but unable to do because of that exception which is:

Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date.
To generate a developer certificate run 'dotnet dev-certs https'. To trust the certificate (Windows and macOS only) run 'dotnet dev-certs https --trust'.
For more information on configuring HTTPS see https://go.microsoft.com/fwlink/?linkid=848054.

After spending hours on google I have found many links in which first to install certificate like

dotnet dev-certs https --clean
dotnet dev-certs https --trust

**Docker - certificate not trusted**

     1. Delete the C:\Users{USER}\AppData\Roaming\ASP.NET\Https folder.
     2. Clean the solution. Delete the bin and obj folders. 
     3. Restart the Development tool. Visual Studio Code- 2019

After doing all above stuff facing same error, am I doing some wrong thing.

Here is the dockerfile

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1-nanoserver-1809 AS base
WORKDIR /app
EXPOSE 80
EXPOSE 443
user ContainerAdministrator

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-nanoserver-1809 AS build
WORKDIR /src

COPY ../Certificate/idsrv3test.pfx .

COPY ["Tests-Identity/Tests-Identity.csproj", "Tests-Identity/"]
RUN dotnet restore "Tests-Identity/Tests-Identity.csproj"
COPY . .
WORKDIR "/src/Tests-Identity"
RUN dotnet build "Tests-Identity.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "Tests-Identity.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "Tests-Identity.dll"]

Here is the docker-compose.override.yml

version: '3.4'

services:
  tests-identity:
    environment:
       - ASPNETCORE_ENVIRONMENT=Development
       - ASPNETCORE_URLS=https://+:443;http://+:80

    ports:
      - "5000:80"
      - "5001:443"
    volumes:
      - ${APPDATA}/Microsoft/UserSecrets:C:\Users\ContainerUser\AppData\Roaming\Microsoft\UserSecrets:ro
      - ${APPDATA}/ASP.NET/Https:C:\Users\ContainerUser\AppData\Roaming\ASP.NET\Https:ro
dockerfile docker-compose docker .net-core x509certificate
3 Answers

Muneer As per my understanding the following command will only help you when you are running your application under IISEXPRESS this will absolutely not help you, but my understanding you are trying to run the API under 'Docker Compose' project 

dotnet dev-certs https --clean
dotnet dev-certs https --trust

So first you need to remove the admin container user in your docker file

user ContainerAdministrator

and also remove this line

COPY ../Certificate/idsrv3test.pfx .

After that add the following parameter in "X509Certificate2" which will be in your Certificate.cs file

enter image description here

Please try this link it will definitely helps you a lot https://github.com/dotnet/dotnet-docker/issues/863

user_108463900

Use Dockerfile without any troubles

FROM ${DOCKER_REGISTRY}dotnet/core/sdk:3.1 AS build
ARG VER

WORKDIR /src
COPY . .
RUN dotnet restore --ignore-failed-sources
RUN dotnet publish -c Release --version-suffix "%VER%" -o /app
RUN dotnet dev-certs https -ep ./server.pfx -p 123
user_21545100

To install a certificate (pfx or otherwise) into a nanoserver container during the docker build process, you need to use certoc.exe. Certoc.exe is part of windows server, you can find it on any server in c:\windows\system32\certoc.exe. It doesn't come with nanoserver, however.

Here's a section of dockerfile that I use to install CA certs into the trusted root certification authorities ("root") store:

RUN MKDIR "\temp"
WORKDIR "/temp"
COPY ["my-ca.cer","/temp"]
COPY ["certoc.exe","/temp"]
USER "ContainerAdministrator"
RUN .\certoc -addstore root "c:\temp\my-ca.cer"
RUN del /f /q .\certoc.exe
RUN del /f /q .\my-ca.cer
USER "ContainerUser"

Note that I'm doing the certificate install as ContainerAdmin, but everything else runs as ContainerUser (which is the best practice).

You can adapt the above to use certoc to import a pfx file, using

USER "ContainerUser"
COPY ["mycert.pfx","/temp"]
RUN .\certoc -ImportPFX -p your_pfx_password_here "My" "c:\temp\mycert.pfx"

which imports the pfx into the personal ("My") store of the container user.

user_115292280
Related