Exporting a web app service certificate

Question

I have a web app service and purchased a custom domain through Azure. I setup the free certificate. There is no option to export the .pfx. Is it just not possible to export the free cert that comes with the custom domain?

I do see if I 'Create App Service Certificate' for $69.99 a year, it says I would be able to export it as .pfx.

Answer 1

@Joe Thanks for asking question!

You are correct that the free certificate provided by Azure App Service for custom domains cannot be exported as a .pfx file. This is because the free certificate is managed by Azure and is not intended for use outside of Azure App Service called as App Service managed certificate.

If you need to export the certificate as a .pfx file, you will need to purchase an App Service Certificate from Azure. The App Service Certificate is a paid service that provides a certificate that can be exported as a .pfx file. The cost of the certificate depends on the type of certificate and the duration of the subscription.

To purchase an App Service Certificate and export it as a .pfx file, follow these steps:

1. In the Azure portal, go to the App Service Certificate page.
2. Click on the Add button to create a new certificate.
3. Follow the instructions to purchase the certificate and configure the certificate options.
4. Once the certificate is created, go to the Certificates page for your web app and click on the Add button to add the certificate.
5. In the Add Certificate pane, select the App Service Certificate option and select the certificate you just created.
6. Follow the instructions to configure the certificate binding for your custom domain.
7. Once the certificate binding is configured, you can export the certificate as a .pfx file by going to the Certificates page and clicking on the Export button.

Refer to the link- https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=portal

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=portal#export-an-app-service-certificate

I hope this helps!

Please let us know if further query, happy to assist.

Answer 2

Hi Joe,

The free App Service managed certificate isn't exportable. Some options to consider are a) obtain a certificate for free using Let's Encrypt b) purchase certificate from third-party provider (costs less than App Service Certificate) c) purchase App Service Certificate as you already mentioned.

Let's Encrypt (LE) is cheapest option, however, there are some downsides. First is, if you have never set up your machine to request and obtain certificate from LE, you will need to spend some time reading/learning. Second downside is the certificate will only be valid for 90 days. This isn't a big deal if you set up scripting to automate the process of obtaining/installing on schedule, but if you are doing everything manually the work will need to be done every 2+ months.

Compare this to a purchased certificate which is valid for about 13 months typically.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP