Serve the Azure Functions host over HTTPS in the Functions sample

[IEvangelist]

Fixes #752

Problem

In the aspire-with-azure-functions sample, the local Azure Functions host (func host start) was only ever served over HTTP. Simply adding --useHttps to the Functions launch profile is not enough — the .NET build of Azure Functions Core Tools cannot auto‑generate a certificate and fails to start:

Auto cert generation is currently not working on the .NET Core build.

func host start --useHttps requires an explicit password‑protected PFX via --cert/--password.

Fix

• ImageGallery.Functions/Properties/launchSettings.json — add --useHttps so Aspire registers an https endpoint for the Functions resource.
• ImageGallery.AppHost/AppHost.cs —
  • Point WithUrlForEndpoint at the https endpoint.
  • In run mode only, export the trusted ASP.NET Core developer certificate via Aspire's WithHttpsDeveloperCertificate(...) and hand the resulting PFX to the Functions host with WithHttpsCertificateConfiguration(...) (--cert <pfx> --password <generated>). The export password is an ephemeral, per‑run secret parameter, so nothing is committed. The wiring is guarded by IsRunMode so it never affects publish/deploy.

Effective local launch becomes:

func host start --port 7221 --useHttps --cert <exported-dev-cert>.pfx --password <generated>

Verification (local)

Tested locally with .NET 10, Aspire 13.4.3, Azure Functions Core Tools v4.12.0, Docker (Azurite):

Before — curl http://localhost:7221/admin/host/status → 200; HTTPS TLS handshake fails (SEC_E_INVALID_TOKEN).

After

• func launches with --useHttps --cert <pfx> --password <generated> and listens on :7221.
• curl https://localhost:7221/admin/host/status (no -k) → 200 OK with {"state":"Running","version":"4.1048..."} — i.e. served over HTTPS using the trusted dev cert.
• Plain http://localhost:7221/... now fails (port is HTTPS‑only).
• Frontend serves over HTTPS (200).
• End‑to‑end regression check: uploaded a 400×300 image to the images container → the ThumbnailGenerator blob trigger produced a 170×128 thumbnail in thumbnails. The pipeline is unaffected.

Prerequisite

A trusted ASP.NET Core developer certificate (dotnet dev-certs https --trust) — already part of the Aspire prerequisites linked in the sample README.

[Copilot]

Pull request overview

Updates the aspire-with-azure-functions sample so the local Azure Functions host can be served over HTTPS, aligning the Functions endpoint with the frontend’s HTTPS usage and avoiding Core Tools’ inability to auto-generate a cert on the .NET build.

Changes:

• Add --useHttps to the Functions project launch profile so Aspire registers an https endpoint.
• Update the AppHost to display the Functions URL via the https endpoint and (in run mode) export the trusted dev cert and pass it to func host start via --cert/--password.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
samples/aspire-with-azure-functions/ImageGallery.Functions/Properties/launchSettings.json	Adds --useHttps to ensure the local Functions host is started in HTTPS mode.
samples/aspire-with-azure-functions/ImageGallery.AppHost/AppHost.cs	Switches the displayed Functions endpoint to https and wires dev-cert export + func args in run mode.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[DamianEdwards]

Given this is only done in run mode, is there any benefit to this being a parameter? Is it just so we can mark it a secret so it gets hidden in the dashboard UI? Parameters show up in the UI and add code here so just want to make sure there's a reasonable benefit.

nit: wrapping

[sebastienros]

Also why use a guid when parameters already handle password generation