Usage of Azure App Service Certificate for Application Gateway and VM/IIS

Question

If I purchase an Azure App Service Certificate, can I use it for both of the following purposes:

1. Integrating it with Application Gateway via Key Vault, and
2. Exporting the certificate and binding it to IIS on a VM?

Answer 1

Hi,

Yes, you can use App Service Certificate with Application Gateway as well as exporting/importing it into certificate store on VM so that it can be used with IIS.

What I prefer is to purchase from third party provider since the cost is way lower ($4-$7/year for third-party vs $70/year for App Service Certificate). Third-party certificate works just as well, and since there isn't much convenience using App Service Certificate when used with Application Gateway or VM.

Below article describes how to export App Service Certificate to .pfx file so that you can import it in VM's Local Computer\Personal store using certlm.msc (make sure to select Mark this key as exportable when importing into VM):

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=portal#export-an-app-service-certificate

Once certificate and its private key are imported into VM, you can export it back out to .pfx file and assign password, that way you can easily upload it to your Application Gateway listener. I find this method easier than pulling it from Key Vault for use with appgw, but you can use whichever method you prefer.

Configuring App Service Certificate in Application Gateway

https://techcommunity.microsoft.com/blog/appsonazureblog/configuring-app-service-certificate-in-application-gateway/4083933

If something above isn't clear or you have questions, please add comment below.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP