I'm running a .NET API with Kestrel inside Docker on an Ubuntu server. The application works except for loading an HTTPS certificate from a PFX file. I created the certificate bundle with OpenSSL, copied it to the host at /etc/docker-certs/my-API.pfx, and pass its path and password through environment variables.
My current Docker command is:
docker run --mount type=bind,src=./my-API.pfx,dst=/app/etc/docker-certs/,bind-create-src -p 8085:80 -e USE_PFX=true -e PFX_PASSWORD=my_password -e PFX_PATH=/app/etc/docker-certs/my-API.pfx -p 8086:8081 --name myAPI localhost:5000/myAPI
Inside the application, PFX_PATH is /app/etc/docker-certs/my-API.pfx. A directory listing shows the expected path, but Directory.Exists(Path.GetDirectoryName(pfxPath)) returns true while File.Exists(pfxPath) returns false.
The certificate is intended to be loaded by Kestrel with options.UseHttps(pfxPath, pfxPassword). Is the bind mount destination incorrect, or is there something else about mounting the file that I'm missing?
2 Answers
A reverse proxy such as Nginx is another good design for this setup. Nginx can terminate HTTPS and forward ordinary HTTP traffic to the API container, so Kestrel does not need to load the certificate itself. It also makes it easier to route multiple containers through subdomains instead of exposing a different port for every service.
The bind mount is treating the source PFX file as if it should be mounted onto a directory. The destination needs to include the filename as well. Mount the file directly:
docker run --mount type=bind,src=/etc/docker-certs/my-API.pfx,dst=/app/etc/docker-certs/my-API.pfx,readonly ...
Alternatively, mount the whole host directory instead:
docker run --mount type=bind,src=/etc/docker-certs,dst=/app/etc/docker-certs,readonly ...
Also make sure the relative source path is being resolved from the directory where you run Docker. Using an absolute host path avoids ambiguity. Once the file is mounted at /app/etc/docker-certs/my-API.pfx, File.Exists should be able to find it.
That makes sense—I was mounting a file to a directory path. I’ll update the destination to include my-API.pfx and use an absolute source path to make sure Docker is using the intended host file.
That’s the direction I plan to take eventually. My Angular container already uses Nginx, and configuring the same certificate there was much simpler. I’d like to use a reverse proxy to route the other containers by subdomain as well.