IdentityServer 4 on AWS Elastic Beanstalk — OpenID Discovery Returns HTTP Endpoints Instead of HTTPS

Question

I'm deploying an ASP.NET Core 9 Web API using IdentityServer 4 on AWS Elastic Beanstalk with an Application Load Balancer (ALB) and a valid ACM certificate.

What works:

• SSL certificate is correctly assigned and DNS-validated (ACM)
• Hitting https://my-domain.com/connect/token returns a valid access token using curl
• My ASP.NET Core app is using AddJwtBearer() to validate tokens

What's not working: https://my-domain.com/.well-known/openid-configuration

It returns all IdentityServer endpoints with HTTP instead of HTTPS, like:

 "issuer": "https://my-domain.com",
 "token_endpoint": "http://my-domain.com/connect/token",
 "jwks_uri": "http://my-domain.com/.well-known/openid-configuration/jwks",
 ...

Because of the protocol mismatch, my API (and any other client) fails to validate JWT tokens due to OpenID Connect metadata being served with the wrong scheme.

• Hosting: AWS Elastic Beanstalk with ALB (HTTPS via ACM)
• App: ASP.NET Core Web API with IdentityServer4
• Environment: ASPNETCORE_ENVIRONMENT=Development

How can I make IdentityServer return correct HTTPS endpoints in the discovery document (/.well-known/openid-configuration)?

Is there anything else I should configure in IdentityServer options or in the ALB setup to ensure the right scheme is detected?

• Tore Nestenius: I recently did blog about this problem at IdentityServer in Docker Containers – Part 1