Receiving Error "SSL Error: Self signed certificate" in Azure App Services

Question

Hello,

Azure App services suddenly giving this error "SSL Error: Self signed certificate" and while hitting from default domain from postman we are getting Web App Unavailable "The web app you have attempted to reach has blocked your access."

Please help us on priority.

Thanks,

Deep G

Answer 1

@Deep_Azure9 , Just checking in to see if you had got a chance to see the previous response by ricardosolisvillegas-4678. To benefit the community find the right answers, please do mark the post which was helpful by clicking on ‘Accept Answer’ & ‘Up-Vote’.

Just sharing additional info:

When an App hosted on Azure App Service, tries to connect to a remote endpoint over SSL, it is important that the certificate on remote endpoint service is issued by a Trusted Root CA. If the certificate on the remote service is a self-signed certificate or a private CA certificate, then it will not be trusted by the instance hosting your App and the SSL handshake will fail with this error.

If you want to have a private certificate, the certificate must meet the following requirements:

• Exported as a password-protected PFX file, encrypted using triple DES.
• Contains private key at least 2048 bits long
• Contains all intermediate certificates and the root certificate in the certificate chain

Just to highlight, App Service has a list of Trusted Root Certificates which you cannot modify in the multi-tenant variant version of App Service, but you can load your own CA certificate in the Trusted Root Store in an App Service Environment (ASE), which is a single-tenant environment in App Service. (The Free, Basic, Standard, and Premium App Service Plans are all multi-tenant, and the Isolated Plans are single tenant.)

We can also use curl -v https://www.bing.com to view SSL handshake via Kudu Console (https://<yoursitename>.scm.azurewebsites.net/ )

If you wish you may leverage free App Service managed certificate (ASMC), you may checkout the prerequisites and features and their limitations. The easiest way to add a private certificate is to create a free App Service managed certificate.

Answer 2

Hello @Deep_Azure9

Thank you for post on this community space.

On my humble opinion, the following article below could fit into your case scenario:

https://confluence.atlassian.com/bitbucketserverkb/resolving-ssl-self-signed-certificate-errors-806029899.html
Resolving SSL Self-Signed Certificate Errors

If that info is not enough for getting solved this, you might take a packet capture and share it here : )

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.