If your windows Azure application is using an SSl certficate, you need to configure it in both your service definition file and .cscfg file. The whole process is explained clearly in the following Microsoft article:
http://www.windowsazure.com/en-us/develop/net/common-tasks/enable-ssl/
Here, I am going to discuss about few considerations while configuring SSL. As you can see from the above Link, the certificate should be defined in the csdef file
<Certificates>
<Certificate name="SampleCertificate"
storeLocation="LocalMachine"
storeName="CA" />
</Certificates>
The store can be either 'LocalMachine' or 'CurrentUser'. And the storenames can be one of the following -My, Root, CA, Trust, Disallowed, TrustedPeople, TrustedPublisher,AuthRoot, and AddressBook.
You can also create your custom store name, which in case the store will be created.
Interestingly, Microsoft by default does not allow direct import to the trusted root store. Even if you give the Storename as "CA" , the cert will be downloaded only to the intermediate cert store. You will have to write a startup task with elevated permissions to move the cert to root store. However, you need to do this only if your SSl cert is issued by a provider who is not included in the Microsoft root certificate program . If a provider is part of the root certificate program, the root certificate corresponding to your SSL certificate will automatically be downloaded to your Azure instance when you deploy it.
The comprehensive list of cert providers included in the root certificate program can be found in this link
Note: Azure had an issue with OS version 2.19_201309-01, where the root certs of providers from the MS root certificate program was not getting downloaded automatically. They have corrected it now and re-released the OS. It is sorted in OS versions 2.19_201309-03 and later..
http://www.windowsazure.com/en-us/develop/net/common-tasks/enable-ssl/
Here, I am going to discuss about few considerations while configuring SSL. As you can see from the above Link, the certificate should be defined in the csdef file
<Certificates>
<Certificate name="SampleCertificate"
storeLocation="LocalMachine"
storeName="CA" />
</Certificates>
The store can be either 'LocalMachine' or 'CurrentUser'. And the storenames can be one of the following -My, Root, CA, Trust, Disallowed, TrustedPeople, TrustedPublisher,AuthRoot, and AddressBook.
You can also create your custom store name, which in case the store will be created.
Interestingly, Microsoft by default does not allow direct import to the trusted root store. Even if you give the Storename as "CA" , the cert will be downloaded only to the intermediate cert store. You will have to write a startup task with elevated permissions to move the cert to root store. However, you need to do this only if your SSl cert is issued by a provider who is not included in the Microsoft root certificate program . If a provider is part of the root certificate program, the root certificate corresponding to your SSL certificate will automatically be downloaded to your Azure instance when you deploy it.
The comprehensive list of cert providers included in the root certificate program can be found in this link
Note: Azure had an issue with OS version 2.19_201309-01, where the root certs of providers from the MS root certificate program was not getting downloaded automatically. They have corrected it now and re-released the OS. It is sorted in OS versions 2.19_201309-03 and later..
Comments
Post a Comment