Unable to use dynamic client certificate with HttpClientFactory

Hello, I used HttpClient before:

var certificate = ...
var password = ...
using (var clientHandler = new HttpClientHandler())
{
    clientHandler.ClientCertificates.Add(new X509Certificate2(certificate , password ));
    using (var certificateClient = new HttpClient(clientHandler))
    {
     // ...
    }
}

The certificate is dynamic and is obtained from the database. unable to services.AddHttpClient for all certificates in ConfigureServices.

Can you tell me how it should be implemented?

[poke]

You can use ConfigurePrimaryHttpMessageHandler to set up the message handler with a certificate:

services.AddHttpClient("example").ConfigurePrimaryHttpMessageHandler(() =>
{
    var handler = new HttpClientHandler();
    handler.ClientCertificates.Add(certificate);
    return handler;
});

The callback is generally called when the HttpClient is being constructed, so it does not happen at the startup time but on-demand when the client is being used. This means that you can effectively configure the certificate at run-time.

It’s also possible to depend on the service provider there, so you could have some other dependency that provides you with the right certificate:

services.AddHttpClient("example").ConfigurePrimaryHttpMessageHandler(sp =>
{
    var certificateProvider = sp.GetService<CertificateProvider>();

    var handler = new HttpClientHandler();
    handler.ClientCertificates.Add(certificateProvider.GetCertificate());
    return handler;
});

[davidfowl]

Did anyone figure this out? With the SocketsHttpHandler it’s possible to write logic to that runs per connection to determine which client certificate to use.