azuresslssl-certificateazure-logic-apps

Accessing private website with self-sign certificate in standard logic app in azure (hosted in WS1 ASP)

I want to access our internal on-premises website, which uses a private certificate generated by our internal authority. I created a private endpoint in the logic app and added virtual network integration. In Kudu I can access the site with the correct port. I can access the site with a virtual machine in the same virtual network after installing the internal certificate authority in the trusted root certificate store.

According to the Microsoft documentation, (here) I have to upload the root CA in the public key certificates of the logic app and set WEBSITE_LOAD_ROOT_CERTIFICATES to the thumbprint of the certificate. I have also set WEBSITE_LOAD_USER_PROFILE to 1.

enter image description here

I still have the error "Could not establish trust relationship for the SSL/TLS secure channel" in the logic app http action.

Have you already faced this case? Microsoft support is not helpful.

Solution

  • In simple terms, if you're using the regular App Service plans (Free, Basic, Standard, or Premium), you can't change the list of Trusted Root Certificates. However, if you're in an App Service Environment (ASE), which is a single-tenant setup, you have the ability to load your own CA certificate into the Trusted Root Store. Just remember, Isolated Plans are the single tenant option, while the others are multi-tenant.

    When your app on Azure App Service attempts to connect to a remote endpoint using SSL, it's crucial that the certificate on that remote service is issued by a Trusted Root Certificate Authority (CA).

    If the certificate on the remote service is self-signed or issued by a private CA, your app instance won't trust it. In such cases, the SSL handshake will fail, and you'll encounter an error message like "Could not establish trust relationship for the SSL/TLS secure channel."

    So, in this case, there are two solutions:

    1.Use a certificate that is issued by one of the Trusted Root Certificate Authorities in App Service on the remote server.

    2.If the remote service endpoint certificate could not be changed or there is a need to use a private CA certificate, host your app on an App Service Environment (ASE) and load your own CA certificate in the Trusted Root Store

    The only way you can load your own CA certificate in the Trusted Root Store is in an App Service Environment (ASE) which is a single-tenant in App Service.

    A common use case is to configure your app as a client in a client-server model. If you secure your server with a private CA certificate, you will need to upload the client certificate to your app

    To upload the certificate to your app in your ASE:

    1. Generate a .cer file for your certificate.

    2. Go to the app that needs the certificate in the Azure portal

    3. Go to SSL settings in the app. Click Upload Certificate. Select Public. Select Local Machine. Provide a name. Browse and select your .cer file. Select upload.

    4. Copy the thumbprint.

    5. Go to Application Settings. Create an App Setting WEBSITE_LOAD_ROOT_CERTIFICATES with the thumbprint as the value. If you have multiple certificates, you can put them in the same setting separated by commas and no whitespace like

    The certificate will be available by all the apps in the same app service plan as the app, which configured that setting. If you need it to be available for apps in a different App Service plan, you will need to repeat the App Setting operation in an app in that App Service plan.

    There's also a feedback in Microsoft Community to "Support for private intermediate CA", you may want to upvote

    Sources: