key vault - create purchased certificate to use with Power Pages

Question

key vault - create purchased certificate to use with Power Pages

Don Bowden 20

I have purchased app services App Service Certificates. I need to confirm the domain associated with my SSL certificate. Then i believe it needs to downloaded from Azure App Services and uploaded into Power Pages "custom domain" configuration. However, when we do SSL Binding on the Power Pages custom domain, it throws this error as below:

User's image

Can you please help me generate the correct certificate for use with the "custom domain" configuration with our Power Pages website.

Anthony Morris 5 Reputation points Microsoft Employee

2025-05-15T19:44:34.44+00:00

Hi Don! Thanks for posting this question.

For the ASC (App Service Certificate), does the subject or the SAN match www.builderchain.ai?
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-05-21T07:14:46.0666667+00:00

Hi Don Bowden, can you please check your private message and share the details.

1 answer

Your answer

Anthony Morris 5 Reputation points Microsoft Employee

2025-05-15T19:44:34.44+00:00

Hi Don! Thanks for posting this question.

For the ASC (App Service Certificate), does the subject or the SAN match www.builderchain.ai?
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-05-21T07:14:46.0666667+00:00

Hi Don Bowden, can you please check your private message and share the details.

Answer 1

Anthony Morris 5 Microsoft Employee

Hi Don,

Also, checking the requirements of the certificate for Power Pages here: https://learn.microsoft.com/en-us/power-pages/admin/add-custom-domain

The certificate you're importing must be password-protected. By default, when you export an App Service Certificate, it is not password protected. In which case, please use a local tool such as OpenSSL or the Windows Certificates snap-in to import, then export your certificate and be sure to password protect the exported certificate. Then, try uploading that to your Power Pages and see if the certificate will then bind successfully.

Don Bowden 20 Reputation points

2025-05-15T20:46:12.8533333+00:00

how can I export certificate that I created. I am the global administrator. I did add key

trying to export to key vault and download from there. I get this error

thanks!
Anthony Morris 5 Reputation points Microsoft Employee

2025-05-15T21:00:05.83+00:00
Hi Don

Instructions on how to export an ASC can be found here: https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-app-service-certificate?tabs=portal#export-an-app-service-certificate

On the App Service Certificates page, select the certificate.

On the left menu, select Export Certificate.

Select Open Key Vault Secret.

Select the certificate's current version.

Select Download as a certificate.

To do this, you must have stored the ASC into a KeyVault when you first purchased the certificate. You can check this by opening the "Certificate Configuration" blade and verifying which KeyVault the certificate is stored in.
Don Bowden 20 Reputation points

2025-05-15T21:08:56.58+00:00

I am able to select the certificate, and can select the Export Certicate option. But then no Open Key Vault Secret option. See below. thank you.

Anthony Morris 5 Microsoft Employee

Don, has the domain ownership verification completed yet? If not, then the certificate would not be available for use just yet.

If the domain verification has completed, please try to export the certificate with Powershell:

$ascName = <app-service-cert-name>
$ascResource = Get-AzResource -ResourceType "Microsoft.CertificateRegistration/certificateOrders" -Name $ascName -ResourceGroupName <group-name> -ExpandProperties
$keyVaultSecretName = $ascResource.Properties.certificates[0].$ascName.KeyVaultSecretName
$CertBase64 = Get-AzKeyVaultSecret -VaultName <key-vault-name> -Name $keyVaultSecretName -AsPlainText
$CertBytes = [Convert]::FromBase64String($CertBase64)
Set-Content -Path appservicecertificate.pfx -Value $CertBytes -AsByteStream

Don Bowden 20 Reputation points

2025-05-15T21:23:36.98+00:00

here is what is being attempted:

Configuring Azure Front Door - standard to work with Power Pages "custom domain" configuration.

Azure Front Door and its self-generated SSL certificates are working for our five apex domains:

builderchain.net
builderchain.io
builderchain.ai

builderpay.io

buildervalidation.com

We have Power Pages as our Endpoint that must support both authenticated and unauthenticated users.

Power Pages has been configured previouslu in our tenant to work with Azure Front Door being routed to Power Pages using a custom domain that must have the subdomain "www". (note: Apex domain as handled using Front Door Rules).

We have an Azure App Service Certificates purchase SSL certificate for builderchain.ai (that domain name needs to be confirmed). We will then need to convert the certificate to the format required by Power Pages where a password can be provided.

Then we need to upload the certificate into Power Pages "custom domains" configuration, successfully bind that certificate to the "host name" (and we have had several failed attempts here).

I do believe we are close. Once we have a successfully configured custom domain in Power Pages and Azure Front Door routing to our Power Pages endpoint, then we can close this case.

Thank you.
Anthony Morris 5 Reputation points Microsoft Employee

2025-05-15T21:26:36.06+00:00

Ah, thanks for the additional insight!

Your solution is sound - I think you are headed in the right direction indeed. Once your domain ownership is verified, the certificate will be issued and stored in the KeyVault. Once in the KeyVault, you can export the certificate from there, work some magic to password protect it, then upload to Power Pages to bind to your custom domain.
Siva Nair 2,420 Reputation points Microsoft External Staff Moderator

2025-05-15T23:59:54.44+00:00

Hi Don Bowden,

Just checking back to see if you got a chance to check Anthony's response and was helpful, do let us know.
Bodapati Harish 820 Reputation points Microsoft External Staff Moderator

2025-05-16T14:57:32.6833333+00:00

Hello Don Bowden,

Once domain ownership verification is completed and the certificate is issued and stored in Key Vault, you can use the PowerShell script provided by Anthony to export the certificate.

After exporting, you need to convert the certificate to a password-protected PFX format. This can be done by importing the .pfx file into your local certificate store or using tools like OpenSSL, then exporting it again with a password.

Power Pages requires the certificate to be password protected to successfully bind it to your custom domain.

Once you have the password-protected certificate, upload it to Power Pages under Custom Domains and bind it to your subdomain ( www.builderchain.ai).

Finally, ensure that Azure Front Door is correctly configured to route traffic to your Power Pages endpoint.
Don Bowden 20 Reputation points

2025-05-16T18:26:42.93+00:00

How can i export a purchased ($69) App Service Certificates certificate for domain builderchain.ai. I see the "Export Certificate" option below. But no button to export. BTW, this is my marketing website that is down and we have investors who need to see it.

Help is appreciated.
Harshitha Veeramalla 1,306 Reputation points Microsoft External Staff Moderator

2025-05-19T11:34:42.1+00:00

Hi Don Bowden,if you click on Learn more option in the above screenshot, it will redirect to a GitHub it has clear steps to export.Did you get a chance to look into it ?
Sampath 3,750 Reputation points Microsoft External Staff Moderator

2025-05-20T16:44:55.4733333+00:00

Hi Don Bowden, please check the private message and reply.

Share via

key vault - create purchased certificate to use with Power Pages

1 answer

Your answer