I have a .NET web application which connects to a database hosted in the cloud on Microsoft's SQL Azure platform. Now I'd like to use Domo, a third-party cloud-based business intelligence service, to do some reporting on the data in the Azure database. The Domo consultant has told me that he needs a CA certificate path for the database server (in addition to other standard connection info) in order to connect to it. He has suggested that I need to get a cert and apply it to the database server. However, according to what I have read in the documentation, SQL Azure always uses SSL; it is not possible to connect to it otherwise. Given that I am already connecting to it successfully in my application (using Entity Framework 6), there must be a cert already there (Microsoft's), and therefore a certificate path. How do I find out what the certificate path is? The database server name has the form xxxxxxxxxx.database.windows.net.
And to take this one step further you can get the path and content of the cert by running the following command through OpenSSL.
openssl s_client -connect {yourdbname}.database.windows.net:443 -showcerts
Took me awhile to remember how to do that.
I was able to confirm that SQL Azure DB always uses SSL and therefore does have a cert already installed. I found the certificate path by plugging the database server name (xxxxx.database.windows.net) into the online SSL certificate verification tool at DigiCert.com (https://www.digicert.com/help/). The path was listed at the bottom.
Related
I've created a secured SF cluster from the portal, but I can't connect to the explorer from the browser or deploy my app from VS. I have the cluster certificate (the one it makes you create on a Key Vault when you first deploy the cluster) installed on my machine. I got the .pfx file from the Key Vault and installed it on my Windows machine both with double click/wizard and with Powershell Import-PfxCertificate cmdlet.
Still after that, VS says Failed to contact the server. Please try again later or get help from "How to configure secure connections"
I tried added an client "admin" certificate, but it only asks me for the Thumbprint or the subject name, where I put the ones from the previously created cluster certificate. I don't really know if I need to buy a client certificate to make it work, or where do I get it?
And as I said, I can't access to the explorer using the browser either. Any ideas?
Here some screenshots:
This error message might be:
- The certificate issuer authority is not trusted
- because the certificate you installed is not valid or does not target the domain you are trying to access.
if the certificate issuer is not trusted, you might have to:
Trust then, please see this link
Or, get a new certificate from a trusted and execute the steps below
If the certificate is invalid, or misconfigured:
The message is chrome telling you that the certificate is not valid, and you can proceed on your own risk. You should be okay if you click Proceed to xyz.dev.eastus.cloudapp.com.
To deploy applications from Visual Studio to the cluster, you have to install the PFX certificate in the machine, and add the thumbprint to the publish profile file. See more in this link
How to make it work:
Register the domain you want, here I will say as www.example.com
Register the CNAME record on your DNS provider pointing to your Service Fabric default domain likexyz.dev.eastus..cloudapp.com.
Get a PFX certificate from a trusted authority, or your own self-signed certificate if it is for internal use only.
Add the certificate to key vault
Configure the VMSS to use the certificates from key vault
Update your cluster configuration with your certificate thumbprint
This link and this link provides the documentation on how to setup the cluster certificates.
And the following link has a detailed explanation how setup applications:
https://ronaldwildenberg.com/custom-domain-name-and-certificate-for-your-azure-service-fabric-cluster/
If you just want to create secure cluster for Dev and Test purposes, you could just create from the portal and let azure generate the correct certificate for you. For production workloads, you should create your certificates, Please take a look at this link for more info.
I followed this link https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-rm-ps#Certificates to create a VPN in Azure. So,
I created a root certificate and uploaded to management portal.
Used PS script to create the VPN
Created client certificate and installed the VPN Client package.
My VPN is working as expected. My question is now can I delete this certificate from management store now ? Is it must to upload the certificate to management store to create this VPN ? How does the authentication works in this case ?
My question is now can I delete this certificate from management store
now ?
By default, we can't delete this certificate.
Is it must to upload the certificate to management store to create
this VPN ?
Yes, we have to upload the certificate to it, it is a by design behavior.
We can publish our public certificate to Internet, we only should keep the private certificate.
How does the authentication works in this case ?
Here a blog about how does certificate-based authentication work, please refer to this link.
you cannot delete the root certificate that you uploaded to Azure. It is used to authenticate the certificates presented by the connecting clients.
I'm in the Azure Portal UI attempting to connect our new Azure Search service to our SQL Server on our Azure VM. The UI very simply asks me for a connection string, a username and password. I started by using the exact connection string that is used in all our .Net config files, with which there is no issue connecting. No matter how I tweak the connection string based on many threads I've read here at S/O (set Encrypt to False, set TrustServerCertificate to True) I get this error testing the connection:
"A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The certificate chain was issued by an authority that is not trusted.) Learn more about connecting to Azure SQL VMs, http://go.microsoft.com/fwlink/?LinkID=826562"
I must admit that the info in that MS link is like a foreign language to me. As none of those steps have ever been required for me to connect to this SQL Server, I continued my research which lead me to all the different aforementioned tweaks to the connection string.
As none of these tweaks worked, it seems the answer truly lies in that MS article - would someone be able to provide a step-by-step as I am completely new to certificates.
I'd also still fail to understand why I have no issues connecting to this SQL Server from any other app/service/util and only get this error here, but if it works it works and I won't complain!
The basic issue here is that your SQL Server must have a certificate issued by a trusted certificate authority, not a self-signed cert typically used in intranet apps. I suspect the connection strings worked in other apps because they either don't use encryption or trust self-signed certs (that's what TrustServerCertificate setting does).
Please follow the directions in the article you linked - that's the most authoritative step-by-step guide I'm aware of.
Alternatively, if you don't want to configure certificate and ports, you can consider using Azure Data Factory to push data to Azure Search.
I am developing a windows service application that will run on customer PC/servers and access a Web API endpoint hosted in an Azure Website. It needs to authenticate the user, and I would prefer not storing credentials on the customer's machine. So, I've landed on client certificates to authenticate the users. I have this working against a local, non-Azure Website IIS instance with self-signed certificates. However, I'm unable to get it working in an Azure Website.
As far as I can tell, there are two issues that I'm not finding much documentation on:
How do I install my own CA certificate in the Trusted Root of the Website instance(s)? Or will this only work with CA certificates that are already trusted?
How do I enable "Accept Client Certificates" for this application? In IIS you do this under "SSL Settings". Documentation indicates that modifying the system.webServer/security/access node of app.config will accomplish this, but obviously you can't do that in Websites. Documentation for websites suggests this node is unlocked for use in web.config, however adding that node results in an error "The page cannot be displayed because an internal server error has occurred.", even if custom errors is off.
For Azure web sites vs web roles client authentication options are rather limited. Websites don't let you run programs with elevated permissions, which is required for making IIS changes and storing certificates into the trusted root.
There's a way to configure you website to always (you don't get the benefit of making it optional as with IIS 'Accept' configuration) request client certificate. This feature is currently only available through Azure management REST API, you can't access it through the portal UI. You can find more information here.
Essentially you turn on clientCertEnabled website setting to true. The mechanics of this option are different from traditional client authentication where server needs to have a CA certificate with which the client cert is signed in its trusted root. The server doesn't run any validation on the client certificate, the application needs to run the cert check itself, which comes in a request header "X-ARR-ClientCert". GetClientCertificate() extension method on HttpRequestMessage will parse it automatically.
Alternatively, you can host your Web API as a web role. That gives access to running startup tasks with elevated permissions that allows access to trusted root and making IIS configurations, more details/examples here. You can either copy the CA certificate to the app folder or upload to the user store via Azure portal so that it is available for copying over to the trusted root in a startup task. IIS changes can be made via “Microsoft.Web.Administration” library available as NuGet package through ServerManager class.
For question 2, here's a blog post on how to install client certificates on Azure Websites: http://azure.microsoft.com/blog/2014/10/27/using-certificates-in-azure-websites-applications/
For question 1, you can't install your own CA certs as trusted root certificates, but if you have certs from a CA that's already trusted then you can use them without any issues.
Apologies for what is probably a question about a simple task but I'm brand new to Azure and a little worried I get this wrong. Actually, I have a new client and don't even have the access yet to their Azure yet have a proper look. The question is:
My new client has an existing MVC application running on IIS within Azure. This application must communicate with a third party SOAP (.asmx) web service that requires parts of the SOAP message to be signed using an SSL digital certificate.
So, I need to install the certificate on Azure. My problem is that the articles I have found deal with securing the website using the certificate and Https - which I don't want.
Can someone please point me to a good article (or show here if simple enough) that shows how to install it for the purpose of communicating with this third party service?
Any help is really appreciated here so that I can hit the ground running.
The approach for installing any certificate is the same. So you would use the same approach as you would for installing SSL certificate. So the steps would be:
Upload the certificate first in the cloud services certificate section. Note down the certificate thumbprint.
In Visual Studio, open up your role's properties and go to "Certificates" tab and specify that certificate thumbprint along with the certificate store location where you want this certificate to be installed.