Add self-signed root certificate to Azure App Service


Alex Meyer

I have an Azure based .NET web application that we are trying to connect to a client's local ADFS environment. We are able to access the resource through the Azure Hybrid connection, but when we try to get the authentication headers from ADFS, we get a certificate error.

After doing some digging, we found that instead of using a certificate from a trusted root CA, they used a self-signed certificate. The client has sent us its root CA (and intermediate) certificates and asked us to make our Azure application trust those certificates.

1) Is this possible?

2) Is there any security risk in doing this?

I found documentation on adding a certificate to your app service, but I don't think that would "trust" any certificate signed by its root CA certificate, but only the certificate itself. https://docs.microsoft.com/en-US/azure/app-service/app-service-web-ssl-cert-load

I also found this question, which is from 2015, and was curious if this answer has changed since then. How to trust Active Directory root CA certificate in Azure Web Application?

The actual error I'm currently getting when trying to connect to its ADFS is:

System.Net Info: 0: [13800] SecureChannel#55196503 - Remote certificate has error:

System.Net Info: 0: [13800] SecureChannel#55196503 - Failed to build certificate chain for trusted root authorities.

System.Net Information: 0: [13800] SecureChannel#55196503 - User confirmed that the remote certificate is invalid.

System.Net Error: 0: [13800] Exception in HttpWebRequest#44115416::- The underlying connection was closed: Could not establish trust relationship for SSL/TLS secure channel.

Marilee Turscak-MSFT

No, it is still not possible to use self-signed certificates. Due to security concerns, the requirements have not changed.

Quoting from the MS docs, here are the requirements for your SSL certificate:

To use a certificate in App Service, the certificate must meet all of the following requirements:

  • Signed by a trusted certificate authority
  • Export as password protected PFX file
  • Contains a private key that is at least 2048 bits long
  • Include all intermediate certificates in the certificate chain

See more in the June 2018 guide

Related


Add self-signed root certificate to Azure App Service

Alex Meyer I have an Azure based .NET web application that we are trying to connect to a client's local ADFS environment. We are able to access the resources through the Azure Hybrid connection, but when we try to get the authentication headers from ADFS, we g

Add self-signed root certificate to Azure App Service

Alex Meyer I have an Azure based .NET web application that we are trying to connect to a client's local ADFS environment. We are able to access the resources through the Azure Hybrid connection, but when we try to get the authentication headers from ADFS, we g

Add self-signed root certificate to Azure App Service

Alex Meyer I have an Azure based .NET web application that we are trying to connect to a client's local ADFS environment. We are able to access the resource through the Azure Hybrid connection, but when we try to get the authentication headers from ADFS, we ge

Add self-signed root certificate to Azure App Service

Alex Meyer I have an Azure based .NET web application that we are trying to connect to a client's local ADFS environment. We are able to access the resource through the Azure Hybrid connection, but when we try to get the authentication headers from ADFS, we ge

Add self-signed root certificate to Azure App Service

Alex Meyer I have an Azure based .NET web application that we are trying to connect to a client's local ADFS environment. We are able to access the resource through the Azure Hybrid connection, but when we try to get the authentication headers from ADFS, we ge

Add self-signed root certificate to Azure App Service

Alex Meyer I have an Azure based .NET web application that we are trying to connect to a client's local ADFS environment. We are able to access the resource through the Azure Hybrid connection, but when we try to get the authentication headers from ADFS, we ge

Add self-signed root certificate to Azure App Service

Alex Meyer I have an Azure based .NET web application that we are trying to connect to a client's local ADFS environment. We are able to access the resource through the Azure Hybrid connection, but when we try to get the authentication headers from ADFS, we ge

Certenroll on Azure - Generate Self Signed Certificate

Jakub Holovsky I have used Certenroll ( CERTENROLLLib ) to build a create self signed certificate . All of this works locally, but once I deploy it to Azure I get : Server API Error: Message: CertEnroll::CX509Enrollment::__CreateRequest: Access is denied. 0x80

Certenroll on Azure - Generate Self Signed Certificate

Jakub Holovsky I have used Certenroll ( CERTENROLLLib ) to build a create self signed certificate . All of this works locally, but once I deploy it to Azure I get : Server API Error: Message: CertEnroll::CX509Enrollment::__CreateRequest: Access is denied. 0x80

Certenroll on Azure - Generate Self Signed Certificate

Jakub Holovsky I have used Certenroll ( CERTENROLLLib ) to build a create self signed certificate . All of this works locally, but once I deploy it to Azure I get : Server API Error: Message: CertEnroll::CX509Enrollment::__CreateRequest: Access is denied. 0x80