AutoHttps 1.7.0

Two additions: renewal that is failing now escalates on its own, and HTTP/3 is verified rather than assumed. Only the core AutoHttps package changed; the Cloudflare, Route 53, Redis and Azure packages are unchanged.

Renewal that is not going to finish in time

A failed order is retried and usually succeeds, so event 110, which fires on every attempt, is the wrong thing to page on. The case that needed a signal of its own is renewal failing for long enough that the certificate will expire. Let's Encrypt stopped sending expiry notifications on 2025-06-04, so nothing outside the process notices that on your behalf.

Near expiry is now a share of the certificate's lifetime rather than a fixed span, which is what lets it be on by default. NearExpiryWarningFraction defaults to half of RenewalThreshold, so a certificate renewing on schedule never reaches the window, and reaching it means renewal has been failing for as long as the threshold left to spare. One span cannot serve both lifetimes the library has to handle: a sixth of a 90 day certificate is 15 days, and a sixth of a 160 hour one is 27 hours. Set it to 0 to turn the warning and the health degradation off.

A run of failures that reaches the window logs event 147 at Error, once per run rather than once per attempt, and the health check turns Degraded and says which of the two situations it is, carrying the failure count and the last reason in its data. Anything that puts a certificate back in hand clears all of it, including a certificate another replica published.

MaxRetryDelay is also held to a tenth of the certificate's lifetime while one is in hand, so a ceiling chosen for a 90 day certificate does not leave a six day one with two attempts between the renewal point and expiry. At the defaults nothing changes.

The new gauge autohttps.certificate.renewal_failures reports how many attempts have failed in a row and returns to zero as soon as one succeeds, which the autohttps.certificate.renewals counter cannot do. A threshold on it means renewal is failing now rather than that it failed at some point.

IAutoHttpsCertificateInspector also reports ConsecutiveFailures, LastFailureAt and LastFailureReason, so a status page can show a failing renewal before the certificate gets close to expiring.

HTTP/3

HTTP/3 works with both wiring styles and needs nothing configured in AutoHttps. QUIC terminates TLS in the transport rather than in the HTTPS middleware, so Kestrel builds a second set of TLS options for it and refuses some HTTPS settings there, OnAuthenticate among them. AutoHttps uses a certificate selector and a handshake callback, neither of which Kestrel refuses on that path.

This release makes that a tested claim rather than an assumption: a real HTTP/3 request against a real certificate authority, with the chain built to that authority's own issuing root. Two requirements belong to the host rather than to this library, and both fail quietly enough to be worth stating:

• On Linux, install libmsquic. It does not ship with .NET and is not in the distribution's own archive, only in Microsoft's. Without it an endpoint that asks for HTTP/3 binds TCP only and logs nothing about it.
• With WebApplication.CreateSlimBuilder, call UseQuic() and UseKestrelHttpsConfiguration(). The slim builder leaves out both. Without the first the endpoint silently binds TCP only; without the second the bind fails outright. CreateBuilder includes both.

The chain caveat carries over from TCP unchanged: UseAutoHttps(listenOptions, ...) sends the issued intermediates over HTTP/3, and the automatic HTTPS-defaults wiring sends the leaf alone, because Kestrel drops a configured chain whenever a certificate selector is in use.

Upgrading

The health check now reports Degraded once the certificate is near expiry. That report existed before but was off unless you passed nearExpiryWarning. It is on now because the threshold is proportional, and a certificate that renews on time never reaches it.

If a readiness probe treats Degraded as unhealthy, and a certificate really is close to expiry because renewal is failing, that instance will now be taken out of rotation. That is the intent, and it is the situation the release is about. To keep the previous behaviour, set NearExpiryWarningFraction = 0.

Everything else is additive.

Packages

• AutoHttps 1.7.0