I have been building AutoHttps, a small library that gets and renews TLS certificates for an ASP.NET Core app on its own. You add the package, name your domains, and the app obtains a certificate from Let's Encrypt (or any ACME authority) and keeps it renewed. Kestrel serves it. There is nothing to run alongside your process, and no NuGet dependencies come with it.
Setup
Three settings:
builder.Services.AddAutoHttps(options =>
{
options.DomainNames.Add("example.com");
options.EmailAddress = "you@example.com";
options.AcceptTermsOfService = true;
});
It wires itself into Kestrel, answers the http-01 challenge from the app's own request pipeline, writes the certificate to disk, and renews it in the background. While AutoHttps waits for the first certificate, it serves a self-signed placeholder, so a fresh connection gets a certificate warning rather than a dropped handshake.
Why I wrote it
LettuceEncrypt was the usual answer for this. It was archived in April 2025, and its last release targets .NET 6. On top of that, Let's Encrypt now issues short-lived certificates that last six days, which changes how often you renew and makes a fixed renewal threshold a poor fit. I wanted something current that a service could depend on without pulling in a tree of packages.
What it does
- http-01 and dns-01 challenges, with wildcards through dns-01.
- Renewal follows ACME Renewal Information (RFC 9773): the authority tells the client when to renew. There is a lifetime-proportional fallback for authorities that do not publish it, which is what lets the six-day certificates renew without extra configuration.
- Certificate profiles, including the shorter lifetimes Let's Encrypt now offers.
- Let's Encrypt, ZeroSSL, Google Trust Services, Buypass, or any ACME directory, with external account binding where the authority requires it.
- Pluggable certificate and account-key storage, a lock for running more than one instance, and a DNS provider interface for dns-01.
- Targets net8.0 and net10.0.
Status
It is new. Point it at the Let's Encrypt staging endpoint while you try it, because production has rate limits. The test suite runs against Pebble, the ACME test server Let's Encrypt maintains, which is a codebase I did not write. I would rather hear that something does not work for your setup than not hear it.
Links
NuGet: https://www.nuget.org/packages/AutoHttps
GitHub: https://github.com/astralmaster/AutoHttps
