Kestrel default certificate not loading full chain

[lindeberg]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

In .NET 8 with Kestrel, the exposed certificate is not full-chain when using these environment variables:

ASPNETCORE_HTTPS_PORTS=8443
Kestrel__Certificates__Default__Path: <path to .crt file>
Kestrel__Certificates__Default__KeyPath: <path .keyfile>

But when using these environment variables, the exposed certificate is full-chain:

Kestrel__EndPoints__Https__Url: https://+:8443
Kestrel__EndPoints__Https__Certificate__Path: <path to .crt file>
Kestrel__EndPoints__Https__Certificate__KeyPath: <path .keyfile>

Expected Behavior

The exposed certificate should be full-chain when using these environment variables:

ASPNETCORE_HTTPS_PORTS=8443
Kestrel__Certificates__Default__Path: <path to .crt file>
Kestrel__Certificates__Default__KeyPath: <path .keyfile>

Steps To Reproduce

In a .NET 8 Kestrel application

1. Have a .crt and key file with a chained certificate
2. Add these environment variables:

ASPNETCORE_HTTPS_PORTS=8443
Kestrel__Certificates__Default__Path: <path to .crt file>
Kestrel__Certificates__Default__KeyPath: <path .keyfile>

3. Start the application
4. Examine the certificate with for example OpenSSL: openssl s_client -connect localhost:<port>
5. Notice only the leaf certificate is exposed

Exceptions (if any)

No response

.NET Version

8.0.100

Anything else?

No response

[amcasey]

@lindeberg Thanks for the clear write-up! I believe this is captured in #43193.