How to handle https for a containerized OIDC server in local development?

Question

I have an OpenID Connect server (OpenIDdict) and an asp.net core webapp in containers behind a TLS termination proxy. In production, all communication between the webapp and the OIDC server can go through the 'outside', based on their public names. However, in development, I'm using self signed certificates that aren't trusted by the containers running the apps, only by my host pc. Because of that, in development, the webapp can redirect the browser to the OIDC server just fine, but when it, for instance, needs to call the token endpoint, it will fail, because the certificate isn't trusted.

A possible solution would be to have the server to server communication go through the internal container network, but I haven't been able to get that to work. Is there a way to make the asp.net core OpenID Connect middleware use a different url (and protocol) for server to server communication?

Another solution would be to install the self signed certificates in the containers, but because that's only needed in development, it seems bad practice to burden the images with that. Is that assessment correct?

I'm hoping I'm missing the most obvious solution. Any ideas?

Answer 1

This is what I ended up doing:

1. I added a custom domain to the hosts file of my pc, pointing to itself.
2. Using openssl, I created a rootDevCA.crt and added it to the trusted root on my pc and in all the container images.
3. With that root certificate, I signed a new certificate for the custom domain and supplied that (including its key) to the proxy.

As long as I keep the key file for the root certificate far away from my source code, there should be no security issues.