Expose YARP resource on well-known HTTPS port

[Kralizek]

What's the best way to expose the YARP resource on a well-known HTTPS port?

https://learn.microsoft.com/en-us/dotnet/aspire/proxies/yarp-integration?tabs=dotnet-cli#customize-host-port

documentation mentions the WithHostPort but it seems to work only with HTTP.

[engineering87]

Hello @Kralizek,
to expose YARP on an HTTPS port, you need to add an HTTPS endpoint and configure TLS in the container:

var builder = DistributedApplication.CreateBuilder(args);

var gateway = builder.AddYarp("gateway")
    .WithEndpoint(scheme: "https", hostPort: 443, isProxied: false)
    .WithConfiguration(yarp =>
    {
        // your routes…
    });

builder.Build().Run();

Make sure your YARP service is configured with a valid certificate.

[Kralizek]

I'm not sure I understand.

I have the following

var ingress = builder.AddYarp("ingress")
    .WithEndpoint(scheme: "https", port: 11400, targetPort: 443, isProxied: false)
    .WithConfiguration(yarp =>
    {
        var backendCluster = yarp.AddCluster(backend);

        yarp.AddRoute("/api/v1/{**remainder}", backendCluster)
            .WithTransformPathRemovePrefix("/api/v1");

        yarp.AddRoute("/swagger/{**remainder}", backendCluster);

        yarp.AddRoute("/schema/{**remainder}", backendCluster);

        yarp.AddRoute("/auth/{**remainder}", backendCluster);

        yarp.AddRoute(frontend);
    });

The logs for the resource show that there is no HTTPS binding

warn: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]
      Storing keys in a directory '/home/app/.aspnet/DataProtection-Keys' that may not be persisted outside of the container. Protected data will be unavailable when container is destroyed. For more information go to https://aka.ms/aspnet/dataprotectionwarning
info: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[62]
      User profile is available. Using '/home/app/.aspnet/DataProtection-Keys' as key repository; keys will not be encrypted at rest.
info: Yarp.ReverseProxy.Configuration.ConfigProvider.ConfigurationConfigProvider[1]
      Loading proxy data from config.
info: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[58]
      Creating key {7ce9b0c5-b0d2-4a56-b5b0-53e67872b5de} with creation date 2025-09-02 13:38:46Z, activation date 2025-09-02 13:38:46Z, and expiration date 2025-12-01 13:38:46Z.
warn: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[35]
      No XML encryptor configured. Key {7ce9b0c5-b0d2-4a56-b5b0-53e67872b5de} may be persisted to storage in unencrypted form.
info: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[39]
      Writing data to file '/home/app/.aspnet/DataProtection-Keys/key-7ce9b0c5-b0d2-4a56-b5b0-53e67872b5de.xml'.
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: http://[::]:5000
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: /

I also tried .WithHttpsEndpoint(port: 11400, targetPort: 443, isProxied: false) but no difference.

[engineering87]

Try to enable HTTPS inside the YARP container by configuring Kestrel with a certificate:

ASPNETCORE_URLS=https://+:443;http://+:80
ASPNETCORE_Kestrel__Certificates__Default__Path=/https/cert.pfx
ASPNETCORE_Kestrel__Certificates__Default__Password=<pwd>

and mount the pfx into /https. After that, map the host port.