Doc "SslProtocols" and "ClientCertificateMode" settable via config#23241
Conversation
Tratcher
requested review from
Rick-Anderson,
adityamandaleeka,
halter73 and
wtgodbe
| "SslProtocols": ["Tls12", "Tls13"], | ||
| "Certificate": { | ||
| "Path": "<path to .pfx file>", | ||
| "Password": "<certificate password>" |
There was a problem hiding this comment.
Password will be flagged by CredScan. We're supposed to use $CREDENTIAL_PLACEHOLDER$; for passwords.
Given this is for localhost I can apply for an exception, but don't we need to tell them not to deploy to production?
Same comment applies to PW below. We tell customers never to put sensitive data in code, so we need to explain why we're breaking our own rule.
But I see the entire doc is loaded with the same JSON password. Should I open an issue to explain password use?
There was a problem hiding this comment.
The certificate details aren't relevant to these specific sections, but you do need to have a cert.
But I see the entire doc is loaded with the same JSON password. Should I open an issue to explain password use?
Yes please.
3 participants
Fixes dotnet/aspnetcore#26246
These were 5.0 features that were only partially covered by the SNI docs.
@Rick-Anderson EDIT: Internal review URL