I'm settings up a Service Fabric cluster in Azure and want to run a web API (using .NET Core) over https. I want to use my CA-signed wildcard (*.mydomain.com) certificate to access this API. But I'm a bit confused as to where I use it when I create the cluster, is it the cluster or client certificate? I'm thinking the client certificate, but the documentation states that this is for admin tools (i.e. the Explorer), so I'm unsure on how to proceed.
And yes I've read a ton of posts and resources, but I still find this confusing.
There are three certificate types. Here is a summary overview of them.
The Cluster certificate is used for the Explorer endpoint and is deployed to the primary nodes. So if you add your *.mydomain.com wildcard cert there, and CNAME something (e.g. manage.mydomain.com) to [yourcluster].[region].cloudapp.azure.com, then when you hit your management endpoint that cert will be what will be presented to the web browser.
The Reverse Proxy SSL certificate is deployed to each of the nodes and is used when using the built-in reverse proxy feature of Service Fabric. In this case this is what is being used when you hit https://api.mydomain.com/YourAppName/YourService/Resource (where api.mydomain.com is another CNAME to yourcluster.region.cloudapp.azure.com). This is used as an alternative to running your own reverse proxy or other offloading layer (Application Gateway, IIS, nginx, API Management, etc).
The Client certificates are used in place of Azure Active Directory authentication to the management endpoint. So instead of managing users in AAD (with the _Cluster AAD application and the Admin / Read-Only roles), you manage access by handing out management certificates (Admin or Read-Only) to your trusted users.
You can also have secondaries these certificates to use in certificate rollover situations.
The way we are using it is to have Application gateway configured in front of service fabric cluster, and web certificate is uploaded to Application Gateway (and dns is pointing to application gateway) In that scenario SSL is terminated at application gateway.
Another possibility is to terminate SSL at each node in service fabric cluster, in this scenario you would need to ensure that certificate gets deployed to each of the nodes.
As for cluster vs client certificate dilemma, I am also confused, but I think the answer is neither. Client certificate is not for sure since this certificate is used to identify you as admin when running service fabric admin ps scripts.
I do not think it is cluster certificate either, here is what MS docs say what it is used for:
Cluster and server certificate is required to secure a cluster and prevent unauthorized access to it. It provides cluster security in two ways:
Cluster authentication: Authenticates node-to-node communication for cluster federation. Only nodes that can prove their identity with this certificate can join the cluster.
Server authentication: Authenticates the cluster management endpoints to a management client, so that the management client knows it is talking to the real cluster. This certificate also provides an SSL for the HTTPS management API and for Service Fabric Explorer over HTTPS.
as far as I am reading into it, this certificate is used for internal cluster authentication, and it is also used so your management tools can be asured that they are working with right cluster.
Related
I have been looking at various tutorials demoing how identity management works as well as API management in azure but I am not seeing an answer to my questions. I understand that managed identities can be used to authorize azure resource to resource communication but I am not seeing how this is done for a web application. Say for example I have an angular website being hosted on an nginx server in an AKS cluster. I understand that I could use Identity management to create Identity resources that make it so that the AKS and APIM are authorized to connect with one another but how would I do this for the angular running application? This application is running in the client's browser, so it seems like this identity management mechanism would not work. How does one secure an APIM so only a given web application can interact with it?
You could secure your API in APIM with the client certificate, then when the app access the API, validate the incoming certificate and check certificate properties against desired values using policy expressions.
For more details, see How to secure APIs using client certificate authentication in API Management.
I have Azure API Management, configured internally and exposed to the public through Azure application Gateway. My API is secured for client certificates, it working perfectly when I test it internally. When I test it externally, I am getting an invalid certificate error. Does Azure Application Gateway block client certificates? How to allow them?
An answer from Microsoft:
We do have option for mutual authentication on Application Gateway
which can allow the mutual authentication between client and
Application Gateway:
https://learn.microsoft.com/en-us/azure/application-gateway/mutual-authentication-overview
However this is still in preview version, which is not included in
SLA. As the mutual authentication between AppGW and the APIM we
double confirmed with the backend engineers, unfortunately the answer
is no we do not support such a function.
I suspect this is not yet possible with Application Gateway: https://feedback.azure.com/forums/217313-networking/suggestions/9379902-allow-mutual-ssl-auth-on-application-gateway
I am playing around with Azure API Management as a SOAP passthrough. I was hoping to get some analytics in place to preview the service.
My trouble is that my client endpoint has SSL validation in place. I can't figure out how to load the .cer file in Azure to satisfy this requirement. At the very least I was hoping to find an option to turn off SSL validation (like I can with curl or even postman).
any one found a way to accomplish this?
API Management provides the capability to secure access to the back-end service of an API using client certificates. Below guide shows how to manage certificates in the API publisher portal, and how to configure an API to use a certificate to access its back-end service.
How to secure back-end services using client certificate authentication in Azure API Management
If you are calling the API Management service with https then the certificate that is presented will match the host name that you are calling with. I'm assuming you were able to change the client to point to your service at https://{servicename}.azure-api.net ?
Or did you change your local hostname file to make that happen? If that's the case, then that is why you are getting an SSL error. Without being able to re-compile your client you cannot disable the SSL validation.
You could configure the custom domain in API Management and if you have access to the certificate, you could attach it to the custom domain. However, you would actually have to change the public DNS for the domain to make that work. I don't think you can enable a custom domain in API Management, provide the certificate and only use your local hostname file to do the mapping. But I will check.
The steps under 'Scenario 7: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel' in Troubleshooting 4xx and 5xx Errors with Azure APIM services is what worked for me. I'm using this approach to bypass validating the SSL cert until I switch from using a self-signed cert to a CA signed one.
I have two VMs with IIS that host my application with Azure Application Gateway distributing the traffic. The gateway is configured to offload SSL and everything is working fine.
However, I'd like to use client certificate authentication on one of the paths of the application - on NetScaler (or some other load balancer) I'd simply put serialized client certificate into HTTP Header (X-Client-Cert).
Can I do something similar with Application Gateway?
At the moment thats not possible, but is in the pipeline of product development of the azure product team.
I am developing a windows service application that will run on customer PC/servers and access a Web API endpoint hosted in an Azure Website. It needs to authenticate the user, and I would prefer not storing credentials on the customer's machine. So, I've landed on client certificates to authenticate the users. I have this working against a local, non-Azure Website IIS instance with self-signed certificates. However, I'm unable to get it working in an Azure Website.
As far as I can tell, there are two issues that I'm not finding much documentation on:
How do I install my own CA certificate in the Trusted Root of the Website instance(s)? Or will this only work with CA certificates that are already trusted?
How do I enable "Accept Client Certificates" for this application? In IIS you do this under "SSL Settings". Documentation indicates that modifying the system.webServer/security/access node of app.config will accomplish this, but obviously you can't do that in Websites. Documentation for websites suggests this node is unlocked for use in web.config, however adding that node results in an error "The page cannot be displayed because an internal server error has occurred.", even if custom errors is off.
For Azure web sites vs web roles client authentication options are rather limited. Websites don't let you run programs with elevated permissions, which is required for making IIS changes and storing certificates into the trusted root.
There's a way to configure you website to always (you don't get the benefit of making it optional as with IIS 'Accept' configuration) request client certificate. This feature is currently only available through Azure management REST API, you can't access it through the portal UI. You can find more information here.
Essentially you turn on clientCertEnabled website setting to true. The mechanics of this option are different from traditional client authentication where server needs to have a CA certificate with which the client cert is signed in its trusted root. The server doesn't run any validation on the client certificate, the application needs to run the cert check itself, which comes in a request header "X-ARR-ClientCert". GetClientCertificate() extension method on HttpRequestMessage will parse it automatically.
Alternatively, you can host your Web API as a web role. That gives access to running startup tasks with elevated permissions that allows access to trusted root and making IIS configurations, more details/examples here. You can either copy the CA certificate to the app folder or upload to the user store via Azure portal so that it is available for copying over to the trusted root in a startup task. IIS changes can be made via “Microsoft.Web.Administration” library available as NuGet package through ServerManager class.
For question 2, here's a blog post on how to install client certificates on Azure Websites: http://azure.microsoft.com/blog/2014/10/27/using-certificates-in-azure-websites-applications/
For question 1, you can't install your own CA certs as trusted root certificates, but if you have certs from a CA that's already trusted then you can use them without any issues.