Export-AppServiceCertificate -loginId yourarmemail@domain.com -subscriptionId yoursubid -resourceGroupName resourceGroupNameOfYourAppServiceCertificate -name appServiceCertificateNameOnce the command is executed, you would see a new file in the current directory called ‘appservicecertificate.pfx’. This is a password protected PFX, the PowerShell console would display the corresponding password. For security reasons, do not store this password in a text file. You can use the password directly from the console as required. Also, don’t forget to delete the local PFX file once you no longer need it.
Once you have installed the exported certificate open the certificate from your certificate store and navigate to the Certification Path tab, it would look something like below,
Now go to https://certs.godaddy.com/repository and download the intermediate certificates and the root certificate. Install all of the certificates downloaded to the same store as your certificate. Once you confirmed that all the certificates in the chain have been installed we can export the certificate with the chain by going to the certificate store, right clicking on the SSL certificate we exported and installed and clicking of All Tasks -> Export ...
In the wizard, make sure you select the option, "Yes, export the private key"
And then under the Personal Information Exchange property, make sure the option "Include all certificates in the certification path if possible" is checked.
Once exported into a new pfx file we can check if the new pfx has the certificate chain included in it by running the command,
certutil -dump <path of the certificate file>You will see the list of the certificates that are part of the pfx from the root to your certificate. A pfx file created with the above steps with all the certificates of the chain contained is well formed and can be uploaded to App Service Web Apps with confidence. Note the CA part of the uploaded pfx file will be discarded when we process the uploaded certificate, we store all the intermediate certificates associated with the certificate to enable the chain to be remade properly in the runtime. Once all the export operation is complete and you have successfully uploaded your certificate clean your machine of any trace of the SSL certificate by deleting the certificate from the store to secure your certificate.
|
Title |
Azure portal Deployment |
Deploying local PFX copy |
Recommendations |
|
Auto/Manual Renew |
When an App Service Certificate is renewed, all the corresponding App Service SSL bindings are updated automatically |
When a certificate is renewed, you would need to manually update all the services that are using a local copy. |
Turn off Auto renew as you won’t know when exactly an App Service Certificate gets renewed with Auto renew and this would end up breaking your SSL endpoints. Manually renew such App Service Certificates before they expire |
|
Rekey |
Just like renewal, the corresponding SSL bindings are updated automatically |
Just like renewal, you would need to manually update all such services. |
|
|
Deployment |
When deploying certificate this way, you don’t need any file locally and there won’t be any secrets to clean up |
When deploying certificate this way, you would have the PFX certificate on local disk. |
Always delete the local copy once you no longer need it as you can create a PFX copy as many times as you want. Also, never store the password shown in PowerShell console locally. This way, even if somehow an adversary gets hold of your local disk, he still won’t be able to use the PFX certificate as it’s protected by a strong password |