From 8bbddbedcc948acf0fe0d97ad48acc587ae66086 Mon Sep 17 00:00:00 2001 From: David Claeys Date: Tue, 1 Apr 2025 12:51:35 +0200 Subject: [PATCH] update readme --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 98f72aa..abebfb4 100644 --- a/README.md +++ b/README.md @@ -52,8 +52,8 @@ ENTRYPOINT ["dotnet", "test.dll"] ### Security implications This images uses the system provided by Microsoft to generate a development certificate and uses the [Kestrel](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/?view=aspnetcore-9.0&tabs=windows) webserver. -In previous .NET versions it was not recommended to expose Kestrel directly to the internet. Now Microsoft claims you can do that. -However you never should use the included development certificate if you want to do that. +In previous .NET versions it was not recommended to expose Kestrel directly to the internet, now Microsoft claims you can do that if you want so. +However you never should use the included development certificate included in this image when doing so. If you want to expose the Kestrel server you should use the **ASPNETCORE_Kestrel__Certificates__Default__Path**, **ASPNETCORE_Kestrel__Certificates__Default__KeyPath** and **ASPNETCORE_Kestrel__Certificates__Default__Password** variables to correclty setup a certificate. The _dotnet dev-certs_ command is not really suited for production environments.