title: Problems running/configure self hosted console application (ASP.net core 2.1, Kestrel) with public certificate on a windows webserver
body: <p>I have developed various webservices in the past (VB ASP.net web-api applications) with https for production.
  I have done the development with http and then setup https on the production servers.
  <strong>To setup a port on the production server for https and the certificate, I have:</strong>  </p>
  
  <ol>
  <li>Imported a public certificate in the certificate store on the
  windows    server configured a specific port for https with netsh.
  E.g:</li>
  </ol>
  
  <blockquote>
    <p>netsh http add urlacl url=<a href="https://+:22224/" rel="nofollow noreferrer">https://+:22224/</a> user=everyone</p>
  </blockquote>
  
  <ol start="2">
  <li>bound the certificate (over the thumbprint) to the port. E.g:</li>
  </ol>
  
  <blockquote>
    <p>netsh http add sslcert ipport=0.0.0.0:22224
    certhash=31cf73308a768100d4d32fe6e77638593e68ab57
    appid={a33a711f-c587-44e5-96bc-dca8a7f3fc3c}</p>
  </blockquote>
  
  <ol start="3">
  <li>Setup the application to listen to the specific port, whereby I have
  read the url from a config file at startup - e.g. <a href="https://IP:Port" rel="nofollow noreferrer">https://IP:Port</a> and applied
  it to (vb.net) HttpSelfHostConfiguration()</li>
  </ol>
  
  <p>This works without problems and I am able to configure the applications as I need it (e.g. configure a port in the config file for http for doing tests on a intranet server, configure another port in the config file for the production environment with https).</p>
  
  <p>Now, I want to do the same with an <strong>asp.net core 2.1.6</strong> application and <strong>it seems not to work the same way.</strong><br>
  Public certificate (comodo) is installed in the certificate store of the windows web server.<br>
  Port 22224 is configured with netsh for https.<br>
  The certificate is bound to the port with netsh (certificate is showed correct with netsh http show sslcert ipport=0.0.0.0:22224<br>
  In <strong>Program.cs</strong>, I add the port to listen with UseUrls:</p>
  
  <pre><code> public static IWebHostBuilder CreateWebHostBuilder(string[] args) =&gt;
              WebHost.CreateDefaultBuilder(args)
              .UseStartup&lt;Startup&gt;() //;
              .UseUrls(GV.cURL, "http://localhost:5000"); 
      }
  </code></pre>
  
  <p>whereby GV.curl contains <a href="https://IP:22224" rel="nofollow noreferrer">https://IP:22224</a> at runtime    </p>
  
  <p>The application run’s fine (over the Internet), if I configure it to a <strong>http</strong>-port (e.g. <a href="http://IP:22222" rel="nofollow noreferrer">http://IP:22222</a>).<br>
  If I set the (configured) https port (<a href="https://IP:22224" rel="nofollow noreferrer">https://IP:22224</a>), the application don’t start and give out the error message:<br>
  <strong>Unable to configure HTTPS endpoint. <em>No server certificate was specified</em>, and the default developer certificate could not be found.</strong></p>
  
  <p>The information’s, I found on the web are confusing and it seems as this theme is a “moving target” (often changes in the base handling of asp.net core x-x).<br>
  <strong>My findings for now:</strong><br>
  The snipped “<strong><em>No server certificate was specified</em></strong>” in the error message indicates, that the certificate <strong>has to be configured in the application?</strong></p>
  
  <p>I have found <strong>an example</strong> to specify a certificate in CreateWebHostBuilder with .useKestrel options:</p>
  
  <pre><code>.UseKestrel(options =&gt;
          {
              options.Listen(IPAddress.Loopback, 5000);
              options.Listen(IPAddress.Loopback, 5001, listenOptions =&gt;
              {
                  listenOptions.UseHttps("certificate.pfx", "topsecret");
              });
  </code></pre>
  
  <p>Note: In my case, I would have to change 5001 to 22224.</p>
  
  <p><strong>Questions:</strong>  </p>
  
  <ul>
  <li><p><strong>Do I really have to configure the (already to the port bound) public 
  certificate also in the asp.net core 2.1 application?</strong></p></li>
  <li><p><strong>If yes, what is the best way to do this (is the example above a good way)?</strong></p></li>
  </ul>