How to Configure SSL for Azure App Service

To configure SSL on an Azure App Service, first upload your SSL certificate to the App Service, then bind the certificate to your custom domain using the TLS/SSL settings in the Azure portal. This enables secure HTTPS connections to your web app.

Syntax

Configuring SSL for an Azure App Service involves these main steps:

• Upload SSL Certificate: Upload your .pfx certificate file to the App Service.
• Bind Certificate: Bind the uploaded certificate to your custom domain.
• Enable HTTPS: Enforce HTTPS to redirect all HTTP traffic.

These steps are done via Azure Portal or Azure CLI commands.

bash

az webapp config ssl upload --resource-group <resource-group> --name <app-service-name> --certificate-file <path-to-pfx> --certificate-password <password>
az webapp config ssl bind --resource-group <resource-group> --name <app-service-name> --certificate-thumbprint <thumbprint> --ssl-type SNI
az webapp update --resource-group <resource-group> --name <app-service-name> --set httpsOnly=true

Example

This example shows how to upload an SSL certificate, bind it to a custom domain, and enforce HTTPS using Azure CLI commands.

bash

az webapp config ssl upload --resource-group MyResourceGroup --name MyAppService --certificate-file ./mycert.pfx --certificate-password MyPfxPassword
az webapp config ssl bind --resource-group MyResourceGroup --name MyAppService --certificate-thumbprint 123ABC456DEF7890 --ssl-type SNI
az webapp update --resource-group MyResourceGroup --name MyAppService --set httpsOnly=true

Output

Certificate uploaded successfully.
Certificate bound to custom domain.
HTTPS only enabled for the app service.

Common Pitfalls

• Uploading a certificate without the private key (.pfx) will fail.
• Binding the certificate to a domain not configured in App Service will not work.
• Not enabling HTTPS enforcement leaves the app accessible over insecure HTTP.
• Using an expired or invalid certificate causes browser warnings.

bash

## Wrong: Uploading .cer file without private key
az webapp config ssl upload --resource-group MyResourceGroup --name MyAppService --certificate-file ./mycert.cer --certificate-password ""

## Right: Upload .pfx file with private key and password
az webapp config ssl upload --resource-group MyResourceGroup --name MyAppService --certificate-file ./mycert.pfx --certificate-password MyPfxPassword

Quick Reference

Remember these key points when configuring SSL on Azure App Service:

• Use .pfx files with private keys for certificates.
• Bind certificates only to verified custom domains.
• Enable httpsOnly to force secure connections.
• Renew certificates before expiration to avoid downtime.

Key Takeaways

Upload a valid .pfx SSL certificate with a private key to your Azure App Service.

Bind the certificate to your custom domain using the certificate thumbprint.

Enable HTTPS only to ensure all traffic is secure.

Avoid using expired or invalid certificates to prevent browser warnings.

Verify your custom domain is configured in App Service before binding SSL.