如何在Windows容器中通过HTTPS运行.NET Framework Docker镜像

一、修改Dockerfile，添加自定义启动逻辑 #

调整原Dockerfile，将端口暴露移至runtime阶段，新增证书目录、自定义启动脚本复制及入口设置：

# BUILD
FROM mcr.microsoft.com/dotnet/framework/sdk:4.8 AS build

WORKDIR /app

# copy csproj and restore as distinct layers
COPY *.sln .
COPY ["_Website Application/*.vbproj", "./_Website Application/"]
COPY ["_Website Application/*.config", "./_Website Application/"]
COPY NuGet.config .
RUN nuget restore -ConfigFile NuGet.config

# copy everything else and build app
COPY ["_Website Application/.", "./_Website Application/"]
COPY ["ExternalLibraries/.", "./ExternalLibraries/"]
WORKDIR "/app/_Website Application"
RUN msbuild /p:Configuration=Release -r:False

FROM mcr.microsoft.com/dotnet/framework/aspnet:4.8 AS runtime

# 暴露HTTP和HTTPS端口
EXPOSE 80
EXPOSE 443

# Install IIS Rewrite Module
WORKDIR /install
ADD https://download.microsoft.com/download/1/2/8/128E2E22-C1B9-44A4-BE2A-5859ED1D4592/rewrite_amd64_en-US.msi rewrite_amd64_en-US.msi
RUN Write-Host 'Installing URL Rewrite' ; Start-Process msiexec.exe -ArgumentList '/i', 'rewrite_amd64_en-US.msi', '/quiet', '/norestart' -NoNewWindow -Wait;

# 创建证书挂载目录
RUN New-Item -Path /docker/certs -ItemType Directory -Force

# 复制自定义启动脚本并设置执行权限
COPY Start-WebApp.ps1 /scripts/Start-WebApp.ps1
RUN Set-ExecutionPolicy RemoteSigned -Scope LocalMachine -Force

WORKDIR /inetpub/wwwroot
COPY --from=build ["/app/_Website Application/.", "./"]

# 设置容器启动入口
ENTRYPOINT ["powershell.exe", "-File", "/scripts/Start-WebApp.ps1"]

二、编写自定义启动脚本（Start-WebApp.ps1） #

该脚本通过环境变量判断是否启用HTTPS，自动配置IIS站点绑定及可选的HTTP重定向：

# 获取IIS默认网站实例
$site = Get-IISSite "Default Web Site"

# 读取HTTPS启用状态，默认关闭
$httpsEnabled = [bool]::Parse($env:HTTPS_ENABLED ?? "false")

if ($httpsEnabled) {
    # 验证证书相关环境变量是否齐全
    if (-not $env:HTTPS_CERT_PATH -or -not $env:HTTPS_CERT_PASSWORD) {
        throw "HTTPS_ENABLED is true but HTTPS_CERT_PATH or HTTPS_CERT_PASSWORD is missing"
    }

    # 将PFX证书导入本地计算机个人存储
    $cert = Import-PfxCertificate -FilePath $env:HTTPS_CERT_PATH `
        -CertStoreLocation Cert:\LocalMachine\My `
        -Password (ConvertTo-SecureString $env:HTTPS_CERT_PASSWORD -AsPlainText -Force)

    # 为默认网站添加HTTPS绑定
    $site.Bindings.Add("*:443:", $cert.Thumbprint, "My")

    # 可选：配置HTTP到HTTPS的永久重定向（依赖已安装的URL Rewrite模块）
    $rewriteConfig = @"
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="HTTP to HTTPS redirect" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>
"@
    $rewriteConfig | Out-File -Path "web.config" -Append -Encoding utf8
}

# 启动IIS服务并保持容器运行
Start-Service W3SVC
while ($true) { Start-Sleep 3600 }

三、容器运行模式说明 #

1. 仅HTTP模式（默认） #

无需额外配置，直接启动容器：

docker run -d -p 80:80 your-image-name

2. 启用HTTPS模式 #

挂载本地PFX证书目录，传递环境变量启用HTTPS：

docker run -d -p 80:80 -p 443:443 `
  -e HTTPS_ENABLED=true `
  -e HTTPS_CERT_PATH=/docker/certs/aspnetapp.pfx `
  -e HTTPS_CERT_PASSWORD=YourCertPassword `
  -v /host/local/certs:/docker/certs `
  your-image-name

参数说明：

• /host/local/certs：本地存放PFX证书的目录，替换为实际路径
• aspnetapp.pfx：你的证书文件名，需与HTTPS_CERT_PATH中的路径一致
• YourCertPassword：证书导出时设置的密码

四、关键注意事项 #

• 必须使用包含私钥的PFX格式证书
• 证书导入到Cert:\LocalMachine\My存储后，IIS进程自动拥有读取权限
• 若不需要HTTP重定向，可删除脚本中对应的URL Rewrite配置部分
• HTTPS_ENABLED默认值为false，无需显式设置即可保持仅HTTP运行

内容的提问来源于stack exchange，提问作者Edgaras