TLS on ASP.NET5.0

[eantunes1980]

Is TLS now working for MQTT-Server as middleware on ASP.NET Core 5.0? I've seen the note on 3.1, but on 5.0 there is no info.
Unfortunately it is not working :(
my code:
var mqttServerOptions = new MqttServerOptionsBuilder() .WithConnectionValidator(c => { ... }) .WithoutDefaultEndpoint() .WithEncryptedEndpoint() .WithEncryptedEndpointPort(8883) .WithEncryptionCertificate(SSLCertificate.Export(X509ContentType.Cert, CertPw)) .WithEncryptionSslProtocol(System.Security.Authentication.SslProtocols.Tls12) .Build();

The Server is still accessible on 1883 without tls and on 8884 is not connecting. I know that it works over websockets but i need a connection without websockets too

[SeppPenner]

Yep, I have it running up for some times already with .Net5. Take https://github.com/SeppPenner/NetCoreMQTTExampleCluster/tree/master/src/NetCoreMQTTExampleCluster.Cluster as a reference project (and remove the Orleans and Serilog stuff if you don't need it --> Clustering and logging). It should work with HTTPS only.

[eantunes1980]

I can't see any ASP stuff in your Cluster Sample. If I'm creating a MQTT Server as standalone in works well. But with ASP, Kestrel and the MQTTnet.AspnetCore files it doesn't work.
.WithoutDefaultEndpoint() has no effect. The Port 1883 is still opened without tls and the port 8883 is closed

[SeppPenner]

Ah, you are talking about the Kestrel integration in ASP, I see. Sorry for that, I misunderstood you there. Maybe this link helps you: https://github.com/chkr1011/MQTTnet/wiki/Server#aspnet-50

[eantunes1980]

Today I solved the problem. I will post the problem here in a few days. Thank you

[behroozbc]

@eantunes1980 hi
how solve it?

[eantunes1980]

Sorry for the late answer. This works for me now. The Problem was missing second "l.UseHttps()". Commented below.

private IWebHost BuildWebHost(string[] args) =>
            WebHost.CreateDefaultBuilder(args)
                .UseKestrel((context, o) =>
                {
                    o.ListenAnyIP(Options.Port); // default http pipeline 
                    if (Options.UseSSL)
                    {
                        o.ConfigureHttpsDefaults(o =>
                        {
                            o.ClientCertificateMode = ClientCertificateMode.NoCertificate;
                            o.ServerCertificate = Options.SSLCertificate;
                        });
                        o.ListenAnyIP(Options.SSLPort, l => l.UseHttps());
                        o.Configure(context.Configuration.GetSection("Kestrel")).Endpoint("HTTPS", listenOptions =>
                        {
                            listenOptions.HttpsOptions.SslProtocols = System.Security.Authentication.SslProtocols.Tls12;
                        });

                        o.ListenAnyIP(Options.TLSPort, l =>
                        {

                            l.KestrelServerOptions.ConfigureHttpsDefaults(httpsoptions =>
                            {
                                httpsoptions.CheckCertificateRevocation = false;
                                httpsoptions.ClientCertificateMode = ClientCertificateMode.NoCertificate;
                                httpsoptions.ClientCertificateValidation = (certificate2, validationChain, policyErrors) =>
                                {
                                //TODO write your own validation method
                                return true;
                                };
                                httpsoptions.ServerCertificate = Options.SSLCertificate;
                            });
                            l.UseHttps(); //<----- this line was missing
                            l.UseMqtt();
                        });
                    }
                    else
                        o.ListenAnyIP(Options.MqttPort, l => l.UseMqtt());
                })
                .UseWebRoot(FileManager.Wwwroot)
                .UseStartup<Startup>()
                .Build();`