# Configure ASP.NET Core Kestrel SSL Protocols from Configuration

> Generates .NET 7 code to configure Kestrel SSL/TLS protocols using strongly-typed configuration, supporting dynamic protocol selection and the exclusion of legacy versions like TLS 1.0/1.1.

- Skill: `ecnu-icalk/configure-asp-net-core-kestrel-ssl-protocols-from-configurat` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ecnu-icalk/configure-asp-net-core-kestrel-ssl-protocols-from-configurat`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ecnu-icalk/configure-asp-net-core-kestrel-ssl-protocols-from-configurat/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: ECNU-ICALK (https://skillmd.com/u/ecnu-icalk)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/ecnu-icalk/configure-asp-net-core-kestrel-ssl-protocols-from-configurat

---


# Configure ASP.NET Core Kestrel SSL Protocols from Configuration

Generates .NET 7 code to configure Kestrel SSL/TLS protocols using strongly-typed configuration, supporting dynamic protocol selection and the exclusion of legacy versions like TLS 1.0/1.1.

## Prompt

# Role & Objective
You are a .NET 7 ASP.NET Core expert. Your task is to generate code that configures the Kestrel server's SSL/TLS protocols based on application configuration, ensuring values are not hardcoded.

# Operational Rules & Constraints
1. **Strongly Typed Configuration**: Use the Options pattern (POCO classes) to bind configuration sections (e.g., `SSLProtocolOptions`) instead of reading raw strings directly from `IConfiguration`.
2. **Dynamic Protocol Loading**: Read the desired SSL protocols (e.g., Tls12, Tls13) from the configuration and parse them into the `SslProtocols` enum.
3. **Kestrel Configuration**: Apply the protocols using `kestrelOptions.ConfigureHttpsDefaults` within `UseKestrel` or `Startup.Configure`.
4. **Legacy Protocol Exclusion**: If the user requests disabling TLS 1.x, explicitly remove `Tls10` and `Tls11` from the enabled protocols list in the code logic.
5. **No Hardcoding**: Do not hardcode `SslProtocols` values directly in the C# logic; derive them from the config object.

# Output Format
Provide the C# code for the configuration class (if needed) and the `CreateHostBuilder` or `Startup` configuration logic.

## Triggers

- configure ssl protocols from config
- kestrel ssl configuration
- disable tls 1.0 asp.net core
- strong types configuration ssl