title: ASP.NET Core, HTTPS and Custom Root CA
body: <p>I've written a little proxy ASP.NET Core Web API app (<a href="https://github.com/mu88/JoplinAsustorMediator/" rel="nofollow noreferrer">see here</a>) that is running on my Raspberry Pi within a Linux Docker container. The app runs under <code>http://raspberry.fritz.box:5200/joplin</code> and forwards all requests to <code>https://nas.fritz.box:9815</code>.</p>
  <p>Using <a href="https://hohnstaedt.de/xca/" rel="nofollow noreferrer">XCA</a>, I've created a custom Root CA and a HTTPS certificate for <code>nas.fritz.box</code>. I've successfully registered the custom Root CA certificate within my Raspberry Pi and <code>curl https://nas.fritz.box</code> works without any problems.</p>
  <p>But within the Docker container, the TLS certificate validation fails. I assume that either Kestrel or the Docker container have their own certificate store.</p>
  <p>So I'd like to achieve the following:</p>
  <ol>
  <li>I can access my app via HTTPS (<code>https://raspberry.fritz.box:5200/joplin</code> instead of <code>http://raspberry.fritz.box:5200/joplin</code>) without certification validation errors.</li>
  <li>Requests towards <code>https://nas.fritz.box:9815</code> do not fail within my app running in the Docker container.</li>
  </ol>
  <p>I assume that the solution to both issues lies in providing the correct certificate(s). But I don't see the path: do I have to provide a single certificate only for <code>raspberry.fritz.box</code> with the complete certificate chain? Or two independent certificates (for <code>raspberry.fritz.box</code> and the custom Root CA)? And how to I have to configure it?</p>
  <p>I've already read the <a href="https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-nginx?view=aspnetcore-5.0#secure-the-app" rel="nofollow noreferrer">Microsoft documentation</a>, but I still don't get it.</p>
  <p>For the sake of completeness: my app runs behind a reverse proxy (nginx) and will be accessed via <code>https://raspberry.fritz.box/joplin</code> in production, where nginx forwards all requests internally to <code>http://raspberry.fritz.box:5200/joplin</code>. Since I've configured both my custom Root CA and the HTTPS certificate for nginx on my Raspberry Pi, I can run <code>curl https://raspberry.fritz.box/joplin</code> from my production machine without any problem.</p>