Installing SSL on Azure VM that has a webapp running on microk8s

prettycold 21

I have an Azure VM (Ubuntu) where I deployed my application (uses python flask and angular) in a microk8s. All this while it had the default domain name. Recently I purchased a domain in godaddy, and changed the DNS to point to the new domain. Now I need to add https to the domain, so I purchased SSL certificate in godaddy. Since mine is not Azure App Services, I'm not sure how to install the certificate on the VM against this domain. All links that I came across was for Azure App services. Any help would be appreciated.

Lex Li (Microsoft) 5,847 Reputation points Microsoft Employee

2022-11-18T05:21:51.107+00:00

So, for your current HTTP only site, how did you configure the traffic to go from port 80 of your Azure VM to the container on microk8s? Without knowing that it is impossible to tell where to open port 443 and install the certificate.
prettycold 21 Reputation points

2022-11-21T06:51:32.217+00:00

Thanks for the question. I'm yet to make any configuration changes, as I'm not sure what exact steps need to be followed.

Just now, I found this url: https://microk8s.io/docs/addon-cert-manager
and this url: https://stackoverflow.com/questions/67430592/how-to-setup-letsencrypt-with-kubernetes-microk8s-using-default-ingress - planning to go through these. Will you be able to point me to such links so that I can try them too.
prettycold 21 Reputation points

2023-01-18T09:10:43.6733333+00:00
@Anonymous - Apologies for the super delayed response. http to microk8s is configured as a service in mircok8s. flask is deployed in gunicorn/nginx in a pod. Does that help?
Lex Li (Microsoft) 5,847 Reputation points Microsoft Employee

2023-01-18T17:35:43.41+00:00

So based on your description, normal HTTP traffic goes through port 80 of your Ubuntu VM, and somehow is forwarded to the gunicorn/nginx pod on MicroK8S. You need to now explain how that traffic forwarding was configured. To enable HTTPS traffic, you need to open port 443 on this Ubuntu VM the same way and forward the HTTPS to the container pod.

If the forwarding was configured via a reverse proxy (like nginx) you can even apply SSL offloading, so that HTTPS traffic ends on the reverse proxy and is converted to HTTP traffic to the pod. And the server certificate you purchased just needs to be installed on the reverse proxy.

prettycold 21

Yes, the forwarding was configured via a reverse proxy. Hence I placed the certificate and key file in /etc/ssl/, added a server block in nginx.conf as below:

server {
        listen 443 ssl default_server;
        ssl_certificate /etc/ssl/certs/mycertificate.crt;
        ssl_certificate_key /etc/ssl/private/mycertificate.key;
        root /var/www/html;
        server_name localhost;

        location / {
            proxy_read_timeout 360s;
            proxy_send_timeout 360s;
            proxy_connect_timeout 360s;

            uwsgi_read_timeout 360s;
            uwsgi_send_timeout 360s;
            uwsgi_connect_timeout 360s;
            include uwsgi_params;
            uwsgi_pass unix:/tmp/uwsgi.socket;
        }
    }

prettycold 21 Reputation points

2023-01-23T09:15:09.0566667+00:00
Thanks for the response @Anonymous . Yes, the forwarding was configured via nginx. Hence I copied the certificates in that pod's /etc/ssl, and added the below block in nginx.conf

The entire build is done through docker. When I do the build and deploy and then hit the url, I see a nginx 404 not found error. When I do a tail for nginx's error log, it says
2023/01/23 09:03:08 [emerg] 19#19: cannot load certificate "/etc/ssl/certs/mycert.crt": BIO_new_file() failed (SSL: error:02001002:system library:fopen:No such file or directory:fopen('/etc/ssl/certs/mycert.crt','r') error:2006D080:BIO routines:BIO_new_file:no such file)

server { listen 443 ssl default_server; ssl_certificate /etc/ssl/certs/mycert.crt; ssl_certificate_key /etc/ssl/private/mycert.key; root /var/www/html; server_name localhost; location / { proxy_read_timeout 360s; proxy_send_timeout 360s; proxy_connect_timeout 360s; uwsgi_read_timeout 360s; uwsgi_send_timeout 360s; uwsgi_connect_timeout 360s; include uwsgi_params; uwsgi_pass unix:/tmp/uwsgi.socket; } }

1 answer

deherman-MSFT 37,846 Reputation points Microsoft Employee

2022-11-17T17:13:17.97+00:00

@prettycold
I understand you have an Azure VM running your web application and a third party SSL cert. You want to enable HTTPS on your VM but are not sure the process in Azure. Please correct me if I am misunderstanding the issue.

Once you have port 443 open for your NSG all the configuration for the SSL needs to be done in your web application. There is no specific Azure configuration needed for this. I am sharing a few resources below which might be helpful for your setup.

https://stackoverflow.com/questions/29458548/can-you-add-https-functionality-to-a-python-flask-web-server
https://blog.miguelgrinberg.com/post/running-your-flask-application-over-https
https://www.youtube.com/watch?v=Gdys9qPjuKs

Hope this helps! Let me know if you run into further issues or need assistance.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Disclaimer: This response contains a reference to a third-party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there.
There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet.
Please sign in to rate this answer.
prettycold 21 Reputation points

2022-11-21T07:00:19.327+00:00

Thanks for the detailed reply @deherman-MSFT . Just 1 point, my application is deployed inside microk8s. Let me first open port 443 as that seems to be the first step.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Installing SSL on Azure VM that has a webapp running on microk8s

1 answer

Your answer