{
  "id": 2532297,
  "title": "Automatic HTTPS on Kestrel in 2026, now that LettuceEncrypt is archived",
  "url": "https://urgent.news/2026/08/22/automatic-https-on-kestrel-in-2026-now-that-lettuceencrypt-is-archived",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-22T07:53:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jhenderson1992/automatic-https-on-kestrel-in-2026-now-that-lettuceencrypt-is-archived-1m3k"
  },
  "original_language": "en",
  "account": "ASP.NET Core applications running directly on Kestrel have faced challenges in obtaining real TLS certificates without the use of nginx or cloud load balancers. The answer to this issue was LettuceEncrypt, which obtained and renewed Let's Encrypt certificates within the app. However, LettuceEncrypt was archived in April 2025. Two changes have impacted the process of securing a Kestrel-based ASP.NET Core app with HTTPS. Firstly, Let's Encrypt began issuing six-day certificates, and reduced the default lifetime from 90 days to 45 days. The latter change made manual renewal obsolete, as certificates couldn't be rotated manually or on a fixed schedule. Secondly, the ACME standard introduced Renewal Information (RFC 9773) which provides clients with suggested renewal windows, enabling them to follow the CA's schedule instead of relying on arbitrary thresholds.\n\nFor .NET applications, an in-process client that handles ACME challenges from the request pipeline and renews on the CA's schedule is required. AutoHttps, a library created by the author of this report, fills this gap. To use it, simply add a single line to your application's configuration: builder.Services.AddAutoHttps(options => { ... }). The library supports ACME challenges, handles both http-01 and dns-01 validation, and works with any ACME authority. It can be configured to use shorter-lived certificates, and the setup is straightforward, requiring only one call.\n\nHowever, there is one limitation to keep in mind. AutoHttps only works if Kestrel is the process handling TLS termination. If your app is behind an nginx, IIS, or a load balancer, the certificate belongs to that component, and an in-process client like AutoHttps cannot assist. The APIs used by AutoHttps are similar to those of LettuceEncrypt, making the migration relatively simple. A short migration guide is available in the library's GitHub repository, which maps the necessary changes. The repository and NuGet package for AutoHttps can be found at https://github.com/astralmaster/AutoHttps and https://www.nuget.org/packages/AutoHttps, respectively.",
  "summary": "If you run an ASP.NET Core app directly on Kestrel, with no nginx or cloud load balancer in front, getting a real TLS certificate has always been the awkward part. For years the answer was LettuceEncrypt, which obtained and renewed a Let's Encrypt certificate inside your app. That project was archived in April 2025, and its last release targets .NET 6. So the question is open again: how do you do…",
  "key_points": [
    "LettuceEncrypt archived in April 2025, impacting HTTPS for Kestrel apps",
    "Let s Encrypt issues six-day certificates, reduced default lifetime to 45 days",
    "AutoHttps library simplifies HTTPS setup for Kestrel in 2026"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}