Use custom certificate with missing hostname on Web App - using IP based SSL

Question

Hi,

I am using a certificate without a hostname, which is an Application Gateway.

I would like to use the certificate directly in Web App using "IP based SSL" binding.

But I am not allowed to import the certificate (for use in IP based SSL) in Web App, and I get the following error:

"The certificate with thumbprint 'xxxxxx' does not match the hostname 'sub.domain.com'.

When I have choosen "IP based SSL", why does Azure care about the host name?

I do understand, that SNI binding would require the certificate to have the correct hostname(s).

Are there any work arounds to do the binding?

Thanks in advance.

Answer 1

Hi @Martin Jørgensen ,

welcome to the Microsoft Q&A Platform!
When using Azure Web Apps with "IP-based SSL" binding, you may encounter hostname validation errors because Azure requires the hostname in the certificate to match the Web App’s hostname, even for IP-based SSL. This is due to the platform's adherence to SSL/TLS security standards, where hostname validation is enforced to prevent security risks from mismatched certificates.
some workarounds to help you proceed with IP-based SSL:

Workarounds for IP-Based SSL Certificate Issues in Azure Web Apps

Generate a New Certificate with the Correct Hostname

• If possible, generate a new SSL certificate that includes the exact Web App hostname (e.g., sub.domain.com) in the Common Name (CN) or Subject Alternative Name (SAN) field. This ensures compatibility with Azure's hostname validation.

Use a Wildcard Certificate

• Wildcard certificates (e.g., *.domain.com) cover all subdomains under a primary domain, which can help bypass hostname restrictions. If your setup allows, replace your current certificate with a wildcard certificate, which Azure will accept across subdomains.

Implement SSL Offloading with Azure Application Gateway

• Azure Application Gateway supports SSL offloading, allowing you to upload the certificate here rather than directly to the Web App.
• By handling SSL termination at the Application Gateway level, this configuration bypasses the Web App’s hostname validation.
• The Web App can communicate via HTTP with the gateway, while the gateway provides the secure front-end connection.

Azure Key Vault Certificate Integration

• Upload the certificate to Azure Key Vault and link it to the Web App using Managed Identity. This offers centralized management and auto-rotation of certificates, which can be more efficient, though hostname validation is still required.
  For references:
• https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex%2CRBAC#binding-a-certificate
  If the answer is helpful, please click "Accept Answer" and kindly upvote it.