DEV Community: John Henderson

AutoHttps: a zero-dependency automatic HTTPS library for ASP.NET Core / Kestrel

John Henderson — Sun, 06 Sep 2026 14:15:19 +0000

Hi. I maintain a library called AutoHttps. It gets a real TLS certificate for your ASP.NET Core app from Let's Encrypt (or any ACME certificate authority) and renews it automatically. You add the package, set three values, and Kestrel serves HTTPS. No external service, and no NuGet dependencies.

builder.Services.AddAutoHttps(options => { options.DomainNames.Add("example.com"); options.EmailAddress = "admin@example.com"; options.AcceptTermsOfService = true; });

What it does:

http-01 and dns-01 challenges, and wildcard certificates through dns-01.
Renews using ACME Renewal Information (RFC 9773), so it follows the schedule the authority asks for and handles short-lived certificates.
Works with Let's Encrypt, ZeroSSL, Google Trust Services, Buypass, or any ACME directory, including a private or internal CA.
Runs several instances safely, sharing one certificate through a lock.
Serves a self-signed certificate at the very start, until the real one arrives.
Gives you certificate change and failure callbacks, a health check, metrics, and a way to read the current certificate from code.

Why it is needed now: LettuceEncrypt, the library most people used for this, was archived in April 2025, and its last release targets .NET 6, which is out of support. At the same time Let's Encrypt is moving to much shorter certificates (six-day ones already exist, and the default is dropping to 45 days), and it now tells clients when to renew through RFC 9773. A client that renews on a fixed 30-day threshold cannot handle either. I could not find a maintained, dependency-free option for Kestrel, so I wrote one.

How it works: AutoHttps attaches to Kestrel, answers the http-01 challenge directly from your request pipeline (so there is no extra listener to run), writes the certificate and the account key to disk so they survive a restart, and checks for renewal on a timer. If something fails, it keeps serving the certificate it already has and retries, so a certificate problem never takes the app down.

It targets net8.0 and net10.0, is MIT licensed, and is on NuGet as AutoHttps: https://www.nuget.org/packages/AutoHttps

Source and docs are on GitHub: https://github.com/astralmaster/AutoHttps

If you try it behind a proxy or with several replicas, I would be glad to hear how it goes, since those setups have the most edge cases.

AutoHttps: automatic HTTPS for ASP.NET Core with no NuGet dependencies

John Henderson — Mon, 24 Aug 2026 08:11:10 +0000

I have been building AutoHttps, a small library that gets and renews TLS certificates for an ASP.NET Core app on its own. You add the package, name your domains, and the app obtains a certificate from Let's Encrypt (or any ACME authority) and keeps it renewed. Kestrel serves it. There is nothing to run alongside your process, and no NuGet dependencies come with it.

Setup

Three settings:

builder.Services.AddAutoHttps(options => { options.DomainNames.Add("example.com"); options.EmailAddress = "you@example.com"; options.AcceptTermsOfService = true; });

It wires itself into Kestrel, answers the http-01 challenge from the app's own request pipeline, writes the certificate to disk, and renews it in the background. While AutoHttps waits for the first certificate, it serves a self-signed placeholder, so a fresh connection gets a certificate warning rather than a dropped handshake.

Why I wrote it

LettuceEncrypt was the usual answer for this. It was archived in April 2025, and its last release targets .NET 6. On top of that, Let's Encrypt now issues short-lived certificates that last six days, which changes how often you renew and makes a fixed renewal threshold a poor fit. I wanted something current that a service could depend on without pulling in a tree of packages.

What it does

http-01 and dns-01 challenges, with wildcards through dns-01.
Renewal follows ACME Renewal Information (RFC 9773): the authority tells the client when to renew. There is a lifetime-proportional fallback for authorities that do not publish it, which is what lets the six-day certificates renew without extra configuration.
Certificate profiles, including the shorter lifetimes Let's Encrypt now offers.
Let's Encrypt, ZeroSSL, Google Trust Services, Buypass, or any ACME directory, with external account binding where the authority requires it.
Pluggable certificate and account-key storage, a lock for running more than one instance, and a DNS provider interface for dns-01.
Targets net8.0 and net10.0.

Status

It is new. Point it at the Let's Encrypt staging endpoint while you try it, because production has rate limits. The test suite runs against Pebble, the ACME test server Let's Encrypt maintains, which is a codebase I did not write. I would rather hear that something does not work for your setup than not hear it.

Links

NuGet: https://www.nuget.org/packages/AutoHttps
GitHub: https://github.com/astralmaster/AutoHttps

Automatic HTTPS on Kestrel in 2026, now that LettuceEncrypt is archived

John Henderson — Sat, 22 Aug 2026 07:53:07 +0000

If you run an ASP.NET Core app directly on Kestrel, with no nginx or cloud load balancer in front, getting a real TLS certificate has always been the awkward part. For years the answer was LettuceEncrypt, which obtained and renewed a Let's Encrypt certificate inside your app. That project was archived in April 2025, and its last release targets .NET 6. So the question is open again: how do you do this now?

Two things have changed, and both matter.

Certificates are getting shorter

Let's Encrypt started issuing six-day certificates this year, and it is taking the default lifetime from 90 days down to 45. The motivation is security, since a leaked key is useful for less time, but the practical effect is that manual renewal is finished. A certificate you rotate by hand, or with a cron job on a fixed schedule, will not keep up. Renewal has to be automatic, and it has to be frequent.

Renewal timing is no longer a guess

Alongside the shorter lifetimes, the authority now tells you when to renew. ACME Renewal Information (RFC 9773, published September 2025) hands the client a suggested renewal window. Instead of picking an arbitrary threshold like "renew when 30 days are left," the client asks the CA and follows the window it returns. That also lets the CA spread renewals out so it is not hit by everyone at once.

What that means for a .NET app

You want a client that runs in process, answers the ACME challenge from your own pipeline, and renews on the CA's schedule with no restart. LettuceEncrypt did the first two but never implemented RFC 9773, and it is no longer maintained. FluffySpoon's EncryptWeMust is in a similar state.

I wrote one for this, AutoHttps (disclosure: I am the author, it is MIT on GitHub). Setup is one call:

builder.Services.AddAutoHttps(options =>
{
    options.DomainNames.Add("example.com");
    options.EmailAddress = "admin@example.com";
    options.AcceptTermsOfService = true;
});

That gets a certificate on first start and keeps it renewed. It answers http-01 from your request pipeline, does dns-01 and wildcards, works with Let's Encrypt or any ACME authority, and has no NuGet dependencies, because the RFC 8555 client is written against the shared framework. For the short-lived certificates above, you opt into the profile:

options.Profile = CertificateProfiles.ShortLived;

The one catch

This only works if Kestrel is the thing terminating TLS. If nginx, IIS, or a load balancer in front holds the certificate, the cert belongs there and an in-process client cannot help. That is the honest boundary: in-process ACME is for the case where your app is the edge.

Coming from LettuceEncrypt

The APIs are close. DomainNames, EmailAddress, and AcceptTermsOfService keep the same names, so most of a migration is renaming the config section and deleting the UseLettuceEncrypt call. There is a short migration guide in the repo that maps the rest.

Repo: https://github.com/astralmaster/AutoHttps
NuGet: https://www.nuget.org/packages/AutoHttps