fix(gateway): detect Certificate:Thumbprint and cover more KestrelTlsInspector cases

src/ZB.MOM.WW.MxGateway.Server/Security/Tls/KestrelTlsInspector.cs

@@ -9,6 +9,13 @@ namespace ZB.MOM.WW.MxGateway.Server.Security.Tls;
 /// </summary>
 public static class KestrelTlsInspector
 {
+    /// <summary>
+    /// Returns <see langword="true"/> when at least one HTTPS endpoint in
+    /// <c>Kestrel:Endpoints</c> has no certificate of its own (no
+    /// <c>Certificate:Path</c>, <c>Certificate:Subject</c>, or
+    /// <c>Certificate:Thumbprint</c>), meaning the gateway must supply a
+    /// generated fallback certificate.
+    /// </summary>
     public static bool RequiresGeneratedCertificate(IConfiguration configuration)
     {
         IConfigurationSection endpoints = configuration.GetSection("Kestrel:Endpoints");
@@ -24,7 +31,8 @@ public static class KestrelTlsInspector
             IConfigurationSection certificate = endpoint.GetSection("Certificate");
             bool hasOwnCertificate =
                 !string.IsNullOrWhiteSpace(certificate["Path"]) ||
-                !string.IsNullOrWhiteSpace(certificate["Subject"]);
+                !string.IsNullOrWhiteSpace(certificate["Subject"]) ||
+                !string.IsNullOrWhiteSpace(certificate["Thumbprint"]);
 
             if (!hasOwnCertificate)
             {