AutoHttps.Redis 1.2.0

AutoHttps.Redis

Redis certificate, account key and challenge stores for AutoHttps. Several instances share their certificates, their ACME registration and their pending http-01 challenge answers through Redis rather than a shared filesystem.

dotnet add package AutoHttps.Redis

Use

builder.Services.AddAutoHttps(options =>
{
    options.DomainNames.Add("example.com");
    options.EmailAddress = "admin@example.com";
    options.AcceptTermsOfService = true;
})
.UseRedis(builder.Configuration.GetConnectionString("Redis")!);

This replaces the certificate store, the account key store, the http-01 challenge store and the lock that stops instances ordering at once. Certificates are written as a hash under autohttps:cert:<name>, the account key under autohttps:account:<name>, a pending challenge answer under autohttps:challenge:<token>, and the lock under autohttps:lock:<name>. Change the prefix if you share the Redis with other things:

.UseRedis("localhost:6379", options => options.KeyPrefix = "myapp:autohttps:");

If your application already registers an IConnectionMultiplexer, that one is used and the connection string here is ignored.

The application starts even when Redis cannot be reached: unless the connection string sets abortConnect itself, the connection is retried in the background, and AutoHttps treats a store it cannot reach as a failed attempt and tries again.

Coordinating instances

Instances sharing a certificate also share its renewal time, so without a shared lock they would all order at the same moment. The lock is a key set only if absent, with a lease the holder renews while its order runs, so an instance that dies holding it keeps the others waiting for one lease at most (LockLease, a minute by default). To use a lock of your own instead, call UseDistributedLock<T>() after UseRedis.

Sharing the challenge store is what lets replicas behind a single DNS name pass an http-01 validation. The authority's request lands on whichever replica the load balancer picks, which is not necessarily the one that ordered, and any of them can then answer it from Redis. Without that, a request reaching another replica gets a 404 and the authorization fails. If you want Redis for certificates but not for challenges, register the challenge store yourself with UseHttp01ChallengeStore<T>() after UseRedis.

Options