Azure function app custom domain TLS binding not working

Question

Hi,

I've a problem with uploading a .pfx certificate (with all the necessary requirements according the documentation) when trying to add a tls binding to a custom domain for a function app.

I've exported my keypair from keystore explorer as a .pfx format.

I tripled checked everything in the certificate & tried already different solutions.... root & intermediate are present, it's a global sign certificate.

Tried to do it with openssl pkcs12 -export command... nothing works.

This certificate is also used in the listener of the app gateway...

Does anyone have an idea?

Thanks & Kr!

Answer 1

Hi,

Yes, we do meet all those requirements.
I managed to upload the certificate by a different way now.

I was able to import it in a keyvault and binding it to the app by the keyvault.

Kr

Answer 2

@Frank

Thanks for reaching here!

If you choose to upload or import a private certificate to App Service, your certificate must meet the following requirements:

• Exported as a password-protected PFX file, encrypted using triple DES.
• Contains private key at least 2048 bits long
• Contains all intermediate certificates and the root certificate in the certificate chain.

Further, to secure a custom domain in a TLS binding, the certificate has more requirements:

• Contains an Extended Key Usage for server authentication (OID = 1.3.6.1.5.5.7.3.1)
• Signed by a trusted certificate authority

Could you please confirm above requirements, let us know if issue remains.