Skip to content

AutoHttps 1.5.0

Choose a tag to compare

View all tags
@astralmaster astralmaster released this 21 Sep 18:10
· 41 commits to main since this release
v1.5.0
f202cc3

Follow-up fixes to the 1.4.0 audit round, plus trim and native-AOT support for the core package. Only the core AutoHttps package changed; the Cloudflare, Route 53, Redis and Azure packages are unchanged.

Fixes

  • Report the wiring mistake where an HTTPS endpoint declared before AddAutoHttps keeps the HTTPS defaults from before AutoHttps was added and goes on serving its own certificate for a managed name. AutoHttps now logs a warning once the host has started, naming the cause and the remedies, instead of leaving the wrong certificate served without a word (in Development, the ASP.NET Core developer certificate).
  • Honour the Retry-After the authority returns with renewal information (RFC 9773). The renewal loop re-checks when the authority asks it to, held to a floor so a small or stale value cannot turn it into a tight poll, and never past a renewal that is already due.
  • Reject a certificate profile the directory does not advertise before the order is sent, with a message naming the profiles that exist, rather than travelling to the authority only to be refused. A profile still reaches an authority that advertises none, where an unknown one is reported rather than dropped.
  • Stop marking issued private keys exportable on Windows. The key container still lives only as long as the certificate object and is removed on dispose, so nothing accumulates, and Schannel, which rejects only ephemeral keys for server authentication, still accepts it.
  • Correct the Buypass deprecation dates. Buypass stopped issuing certificates in October 2025 and terminated its ACME service in April 2026.
  • Run the Pebble suite on a nightly schedule and on demand, and note in the README which suites run per push and which run nightly.

Trimming and native AOT

The core AutoHttps package is now trim and native-AOT compatible, and its build runs the trimming and AOT analyzers so it stays that way. Register it with AddAutoHttps(options => ...). The AddAutoHttps(IConfiguration) overload binds options by reflection, which a trimmed or ahead-of-time build cannot preserve, so it carries RequiresUnreferencedCode and RequiresDynamicCode.

Upgrading

1.4.0 added a guard that fails startup when a later ConfigureHttpsDefaults call replaces the certificate selector AutoHttps installs. 1.5.0 adds the companion case: when an HTTPS endpoint is declared before AddAutoHttps, AutoHttps warns once the host has started rather than serve the wrong certificate silently. If you configure HTTPS endpoints yourself, call AddAutoHttps before declaring them, or bind them with UseUrls or Kestrel:Endpoints, which work in either order.

Assets 2
Loading