Is it possible to use WireMock.Net.Aspire with https?

[TomGathercole]

I'm using WireMock.Net.Aspire 2.8.0 (due to Aspire.Hosting conflicts, I don't believe anything has changed in more recent versions) and attempting to run under a https address like this:

builder.AddWireMock("wiremock", o =>
{
    o.HttpPorts = [9091];
    o.WithAdditionalUrls("https://localhost:9091");
});

But this is failing to start with the following error:

Unhandled exception. WireMock.Exceptions.WireMockException: Service start failed with error: One or more errors occurred. (Unable to configure HTTPS endpoint. No server certificate was specified, and the default developer certificate could not be found or is out of date.
To generate a developer certificate run 'dotnet dev-certs https'. To trust the certificate (Windows and macOS only) run 'dotnet dev-certs https --trust'.
For more information on configuring HTTPS see https://go.microsoft.com/fwlink/?linkid=848054.)

I believe this is because the docker image doesn't have dev-certs setup by default, and there's nothing exposed to customize this through aspire?

[identity-wael]

Your diagnosis is right: the HTTPS listener needs a certificate inside the container. Trusting a development certificate on the host alone does not make its private key available there.

There is an escape hatch in 2.8.0 even though the Aspire options don't expose certificate properties: AddWireMock returns a container resource builder, so you can add a read-only certificate mount and extra WireMock command-line arguments. The 2.8.0 settings parser accepts --X509CertificateFilePath and --X509CertificatePassword; the HTTPS setup uses those to load the certificate.

The configuration shape is:

var certPassword = builder.AddParameter("wiremock-cert-password", secret: true);

var wiremock = builder.AddWireMock("wiremock", o =>
{
    o.HttpPorts = [9091];
    o.WithAdditionalUrls("https://*:9091");
})
.WithBindMount("./https", "/https", isReadOnly: true)
.WithArgs(ctx =>
{
    ctx.Args.Add("--X509CertificateFilePath");
    ctx.Args.Add("/https/wiremock.pfx");
    ctx.Args.Add("--X509CertificatePassword");
    ctx.Args.Add(certPassword.Resource);
});

Export a password-protected development PFX into that local directory first, and supply its password through the Aspire secret parameter. Microsoft's development-certificate export/mount instructions cover that part. Keep the PFX and password out of source control.

Also change the additional listener from localhost to * as above: container-local loopback won't accept connections forwarded to the container interface. Client trust and hostname validation are separate: a localhost development certificate works for a host client calling localhost, but another container calling wiremock needs a certificate/trust setup matching that hostname.

This is based on the 2.8.0 source rather than a run of your AppHost; it preserves the HTTP admin/health endpoint that the Aspire integration creates alongside the additional HTTPS listener.