Share via

Make it possible to use SSL on blob storage using custom domains

Dmitri M 241 Reputation points
2020-10-07T19:04:06.377+00:00

I'm following the recommendation from @AzureSupport twitter handle to post this uservoice suggestion here for better visibility and tracking. (https://twitter.com/AzureSupport/status/1313745281364697090)

Original request:
https://feedback.azure.com/forums/217298-storage/suggestions/3007732-make-it-possible-to-use-ssl-on-blob-storage-using

High-level the issue is that we can add custom domains to storage accounts, but we are not able to make use of custom SSL certificates with those domains. Effectively we either must use Microsoft SSL certificate with default storage URL (ex: mystorageaccountname.blob.core.windows.net) or use custom domain but no SSL at all.

The proposed MSFT solution was initially to use Azure CDN on top of blob storage, but from many comments on uservoice over the years it seems like that's not an appropriate solution in various cases.

Other solutions that were proposed over time were to use an Azure Function to stream blob data, Azure Front Door or Azure API Management. All of these add additional complexity, dependencies and cost.

The customers need a simpler solution just like it exists for App Services and functions (verify custom domain - associate SSL cert to domain - done!)

Azure Storage
Azure Storage
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2020-10-07T22:22:47.107+00:00

    @Dmitri M
    Thanks for making your request. We have forwarded this information to the product team. We will respond back if there is any additional guidance or if they require additional information for your use-case.

    4 people found this answer helpful.
  2. j.bauer 6 Reputation points
    2022-09-11T12:25:37.697+00:00

    Had the same issues with Azure Blob Storage.

    Currently I am using Azure App Gateway (APG) to route traffic from my custom domain to blob storage with SSL:

    1. Setup DNS: configure download.example.org to point to the APG public endpoint (replace example.org with your own DNS root zone)
    2. Route traffic from HTTPS listener to yourblobstorage.blob.core.windows.net backend HTTP endpoint inside APG
    3. Put a status.html into your blob storage container "container-name" and configure a health check to container-name/status.html, because the APG will get a 400 error on the base URL of blob storage, so it would think the blob storage is offline otherwise

    optionally you can setup a HTTP port 80 listener on APG and a redirect rule to route traffic to the HTTPS listener

    It is not a perfect solution, but it does its job...

    1 person found this answer helpful.
  3. Tig 5 Reputation points
    2025-01-05T17:32:20.3533333+00:00

    Microsoft is better off removing the Static Web Site feature than leaving it without the ability to use https with a custom domain. Very frustrating this has not been addressed!

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.