I'll admit i am very new to web app development and have primarily developed offline. I am developing a facebook application and have decided to give windows azure a shot at being my host.
Facebook requires SSL to use and of course on my development machine this works fine, but i do not have my own SSL certificate. In order to have a custom SSL certificate I need to upgrade my azure subscription to get a custom domain and be able to upload my own custom SSL certificate.
Is there any alternative to get my site to allow SSL (https) requests during my development process because paying for a custom SSL, domain and reserved azure instance in an application during the initial build process seems to be a needless expense.
Windows Azure Web Sites is a prime candidate for Facebook application development. If you use the base domain mysite.azurewebsites.net you have SSL without needing your custom domain.
The reason for this being the azurewebsites.net domain has a wild card certificate in place.
Related
I've installed the IIS Admin API, it seems to run by default on port 55539
http://localhost:55539/connect
I need to access this externally and ideally want to use SSL, but I can't find this site running within IIS, when I group my sites by port there are no sites bound to anything other than ports 80 and 443.
Does this run outside of IIS? If so is it possible to use an SSL cert with it.
Thanks
The Microsoft IIS Administration API is a REST API that enables users to configure and monitor their IIS web servers. The IIS instance can be configured with any HTTP client by installing the API on the IIS computer.
You may have misunderstood, IIS Administration API is not a website hosted in IIS, it is a standalone application running on its own port. By default, it runs on port 55539 and is not associated with any particular website in IIS.
Every call to the API requires an access token in the request header, and the service cannot be used from outside the machine unless the port it listens on is opened. You can refer this link to know how to connect to the Management Portal.
In addtion, certificates provide a mechanism for web servers to prove their identity and secure communication channels. The Certificate API is essential for creating websites that serve content over HTTPS. All certificates belong to a certificate store. A list of available certificate stores can be retrieved from the certificate stores endpoint /api/certificates/stores. These certificate stores have a claims property that specifies what operations are allowed on the certificates within the store. You can configure it through the certificates section of the application settings file. Currently the certificate store only supports read operations. In the future the API may support importing, exporting, deleting and creating certificates.
I have created web apps in Azure which use the built-in certificate for *.azurewebsites.net. SSL works fine here.
I have recently created another web app and the certificate it is using is MYSITE.azurewebsites.net. This certificate has a completely different chain than the other one--the root of which is not trusted on my machine.
Can anyone explain why one site would use the wildcard and the other one wouldn't? Also, why would the certificate chain be different?
(The wildcard cert has a DigiCert root, whereas the site-specific domain (MYSITE.azurewebsites.net) has a Cisco umbrella Root CA)
I wrote Azure Support an got in contact with their Azure Web App Product Group. They gave me the following message
This Cisco Umbrella certificate is not coming from Azure. You doesn’t have any SSL binding nor uploaded any certificate into your subscription.
Most likely your client machine is in a network protected by Cisco Umbrella product. Kindly contact to Cisco Umbrella product support team.
Another option to resolve this issue is to bind a custom domain and add a SSL certificate (Free or App Service or any other certificate) so that you do not use .azurewebsites.net URL.
I am providing you relevant articles which will give you all the details about adding custom domain and binding SSL to your App Service.
You can go through them once and then feel free to reach out to me if you have any questions or concerns
https://learn.microsoft.com/en-us/azure/app-service/manage-custom-dns-buy-domain -> Buy a custom domain name for your Azure App Service.
https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain -> Add custom domain to your Azure App Service.
https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-> Bind SSL certificate
I have an web app on Azure with a myapp.azurewebsites.net address and have been following the guide here:
https://learn.microsoft.com/en-USazure/app-service-web/app-service-web-tutorial-custom-domain
Based on this, I have added the hostname in the app settings and it has been verified. I have also added the A Record and TXT record in my domain hosting provider based on the instructions (A Record points to the Azure website IP address) along with installing the SSL certificate for the external domain on the external host.
However when I type in the custom domain name, it goes to the page on the external host instead of the Azure website
What I would like to happen is: https://custom.domain will show the same as https://myapp.azurewebsites.net
Is this even possible ?
As far as I know, the certificate is used to tell the user(client browser) this website is secure.
Normally, there are two reasons why the browser window showed the non-secure page.
You're probably using a self-signed certificate.
You may have left out intermediate certificates when you export your certificate to the PFX file.
So if you want your custom domain doesn't show the non-secure page, you need buy a certificate from the azure or some other company.
After verifying domain ownership, then you could bind this certificate to your azure web app.
After this operation, it will work well.
More details about how to buy certificate with custom domain in the azure, you could refer to this article.
After buying the azure certificate, you could find the certificate as below image shows:
After binding the certificate well, it will not show the no-secure page in the browser.
Image 1:
Image 2:
I saw that creating the fully hosted domain also created A Records pointing to their IP address instead of Azure. Do I need to override these somehow, or how should it work? The tutorial did not show if "contoso.com" was https.
In my opinion, fully hosted domain is the hosting company creates its own web app server to hosting your web app and change the A records point to its own web app server IP address.
So you will find the custom domain show that company pages.
If you want to set the custom domain still points to the azure web app, you need change the A record's IP address as azure web app's address.
If you could find the hosting company has already create a certificate and verified your domain.
Then you could download it and upload it in the azure web app's portal.
After binding the SSL, it will work well.
If the fully hosted domain doesn't contain the certificate, you need buy the certificate by yourself again, upload it in the azure web app portal, change the A record points to your azure web app's IP address.
The problem it seems is that when using a fully hosted site, I can add an A Record but the hosting company keeps using their own A Record which I cannot change, it is part of their "uneditable settings."
Since I don't know how your hosting company's fully hosted site works.
Now, the most easily way is you connect to its support team to change the domain setting firstly, then you follow this article to buy a azure certificate and bind it.
For second option, did you mean to download the SSL from the hosting company and use it as 3rd party SSL in Azure? The A Record would still point to the hosting company right ? Also it seems I do not have an option to download the SSL either in PFX format, I can only view the certificate configuration (CSR, key, etc).
Yes, if you have permission to download the PFX format(if you don't know how to do it, please connect to your hosting company support), you could use it as third party SSL.
If I create an azure website let's assume: myname.azurewebsites.net, I can access this by using http (http://myname.azurewebsites.net) or https (https://myname.azurewebsites.net).
What does this mean? Did I understood it right that basically I don't need an SSL certificate as it has one by default?
I need to build a web service that needs to use SSL. Therefore do I need to buy an ssl certificate and custom domain (not important)? I don't need a custom domain and the default one works fine for me. So can I use my service over SSL provided by Azure: https://myname.azurewebsites.net (is a wildcard certificate)?
If you need to build a web service that needs to use SSL I highly suggest that you use your own domain and your own SSL certificate (buy one) if you are going in production with it. If you just test/play around - than you can safely use the default provided one.
And you are correct about default provided one - you get a (free) SSL for your azure web site as long as it is only bound to the default XXX.azurewebsites.net domain. However the certificate you get there is a wildcard certificate issued to *.azurewebsites.net. I would not use it if I have to go for a production service!
If you are to use SSL features of Azure Web Sites with your own domain and certificate, check out the Pricing and requirement pages. There are important things to note!
I have a single .NET website that is currently running under a traditional hosting account.
I am using a multi-domain (5 domain) SSL certificate to handle domains for different regions i.e.
https://www.mywebsite.com
https://www.mywebsite.net
https://www.mywebsite.de
https://www.mywebsite.at
https://www.mywebsite.co.uk
At a code level I detect the address and localize the site depending on the URL extension.
This has all worked perfectly for the past few years with no problem. Now I want to migrate this site to Windows Azure to allow for better performance and redundancy.
I have successful experience of setting up a site using a Wildcard SSL certficate under Azure (i.e. *.mywebsite.com) but I am keen to sound out whether the multi-domain SSL is also possible.
So my question is does Azure support this kind of certificate and setup, has anyone successfully achieved this and were there any pitfalls?
Just to follow up on my question, it was very simple to implement in the end. I uploaded multiple certificates against my cloud service and the code then worked as before.