Azure Function App Won't Retrieve Public Cert even with WEBSITE_LOAD_CERTIFICATES: *

Question

Azure Function App Won't Retrieve Public Cert even with WEBSITE_LOAD_CERTIFICATES: *

Stephen Mallin 26

I have a .cer loaded into an Azure Function app. User's image

I have an app setting WEBSITE_LOAD_CERTIFICATES: * (I have also tried this with the thumbprint obscured in 1st image)

User's image

I am using the following code to retrieve the certificates

User's image

When I deploy the function app to this slot and run the code, the count is always zero (and the exception is thrown), whether I search for the specific thumbprint or not.

What am I missing to load this .cer into the app so I can attach it to an outbound request?

Thanks.

Resources used:

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code?tabs=windows

https://learn.microsoft.com/en-us/answers/questions/1287639/sending-an-https-request-from-an-azure-function-to

Ryan Hill 30,336 Reputation points Microsoft Employee Moderator

2025-01-27T19:52:08.7366667+00:00
Hey @Stephen Mallin, I'm not certain if you've had the change try yet but:

Does this error only affect the individual slot or does affect all slots?

Are there any error messages in the Import/Upload Certificates detector under Diagnose and solve problems blade?

Are the uploaded certificates listed if you to run dir cert:\localmachine\my in Kudu PowerShell?
Ryan Hill 30,336 Reputation points Microsoft Employee Moderator

2025-01-28T13:47:50.9433333+00:00

Hey @Stephen Mallin circling back to see if you can share any additional insight on the troubleshooting steps provided above or if you were able to resolve your issue.
Stephen Mallin 26 Reputation points

2025-01-28T17:15:01.87+00:00

Thanks Ryan, it is affecting both the secondary slot and the main slot. I've gotten the certificate re-exported as a pfx and successfully uploaded and still it will not download the cert. (X509 collection seen above has zero elements.) Could there be some permission (RBAC issue) missing from the application to pull down certs?

I did see an error message from when I first tried to upload the pfx when I supplied the wrong password during import, but I ran it again when I received the correct password and it uploaded fine.

I was unable to find that path mentioned in kudu powershell.
Stephen Mallin 26 Reputation points

2025-01-28T17:33:59.14+00:00

The troubleshooting tab seems to think the certificates are accessible
Stephen Mallin 26 Reputation points

2025-01-28T17:34:47.8466667+00:00

The troubleshooting view says the certs are accessible
Stephen Mallin 26 Reputation points

2025-01-28T18:02:31.52+00:00

edited
Ryan Hill 30,336 Reputation points Microsoft Employee Moderator

2025-01-29T13:32:50.96+00:00

Hey @Stephen Mallin, is your function hosted in consumption plan? If so, then yeah no kudu console. Let's this offline to dig a little deeper. Please respond to the private message.

Answer accepted by question author

0 additional answers

Your answer

Ryan Hill 30,336 Reputation points Microsoft Employee Moderator

2025-01-27T19:52:08.7366667+00:00

Hey @Stephen Mallin, I'm not certain if you've had the change try yet but:

Does this error only affect the individual slot or does affect all slots?

Are there any error messages in the Import/Upload Certificates detector under Diagnose and solve problems blade?

Are the uploaded certificates listed if you to run dir cert:\localmachine\my in Kudu PowerShell?
Ryan Hill 30,336 Reputation points Microsoft Employee Moderator

2025-01-28T13:47:50.9433333+00:00

Hey @Stephen Mallin circling back to see if you can share any additional insight on the troubleshooting steps provided above or if you were able to resolve your issue.
Stephen Mallin 26 Reputation points

2025-01-28T17:15:01.87+00:00

Thanks Ryan, it is affecting both the secondary slot and the main slot. I've gotten the certificate re-exported as a pfx and successfully uploaded and still it will not download the cert. (X509 collection seen above has zero elements.) Could there be some permission (RBAC issue) missing from the application to pull down certs?

I did see an error message from when I first tried to upload the pfx when I supplied the wrong password during import, but I ran it again when I received the correct password and it uploaded fine.

I was unable to find that path mentioned in kudu powershell.
Stephen Mallin 26 Reputation points

2025-01-28T17:33:59.14+00:00

The troubleshooting tab seems to think the certificates are accessible
Stephen Mallin 26 Reputation points

2025-01-28T17:34:47.8466667+00:00

The troubleshooting view says the certs are accessible
Stephen Mallin 26 Reputation points

2025-01-28T18:02:31.52+00:00

edited
Ryan Hill 30,336 Reputation points Microsoft Employee Moderator

2025-01-29T13:32:50.96+00:00

Hey @Stephen Mallin, is your function hosted in consumption plan? If so, then yeah no kudu console. Let's this offline to dig a little deeper. Please respond to the private message.

Answer 1

Ryan Hill 30,336 Microsoft Employee Moderator

Hey @Stephen Mallin

Thanks for the providing the additional information on your function app. The plan your function is running on is Linux based. That means you need to you alter your code to reflect pulling certificates from in that OS.

See https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code?tabs=linux#load-certificate-in-linuxwindows-containers for more information.

Stephen Mallin 26

Yes, thank you very much for the help, Ryan!

For my public cert, this was the part I was missing in my elastic premium function app:

The following C# code shows how to load a public certificate in a Linux app.

using System;
using System.IO;
using System.Security.Cryptography.X509Certificates;

...
var bytes = File.ReadAllBytes("/var/ssl/certs/<thumbprint>.der");
var cert = new X509Certificate2(bytes);

// Use the loaded certificate

This is what it would have been had i needed to load a private cert:

using System;
using System.IO;
using System.Security.Cryptography.X509Certificates;
...
var bytes = File.ReadAllBytes("/var/ssl/private/<thumbprint>.p12");
var cert = new X509Certificate2(bytes);

// Use the loaded certificate

Share via

Azure Function App Won't Retrieve Public Cert even with WEBSITE_LOAD_CERTIFICATES: *

0 additional answers

Your answer