Delay loading the default development certificate

[Tratcher]

Today Kestrel first tries to load the default development certificate and assign that to all new HttpsConnectionAdapterOptions.ServerCertificate.

This shows up as a measurable % of startup time. It also causes log noise.

It also causes additional complexities with the new SNI support were the cert and the cert selector are mutually exclusive. This may need to get refactored as part of #2357

[muratg]

Costing?

[davidfowl]

Once we have the SNI callback then we can use it here.

[Tratcher]

No, this is later than we'd want, and invoked per connection. You want to load the cert as the server starts, but only if no other cert was provided.

[davidfowl]

Disagree. You want to load the cert only if you’re using https.

[Tratcher]

Yes, but inside the SNI callback is way too late. Do it when you set up HTTPS. One of these two places seems the most likely:

KestrelHttpServer/src/Kestrel.Core/ListenOptionsHttpsExtensions.cs

Line 214 in a37fa83

listenOptions.ConnectionAdapters.Add(new HttpsConnectionAdapter(httpsOptions, loggerFactory));

KestrelHttpServer/src/Kestrel.Core/Internal/HttpsConnectionAdapter.cs

Line 39 in a37fa83

if (options.ServerCertificate == null)