CODEWITHSUNDEEP
azureazure-web-app-serviceclient-certificates
Edwin de Koning
Edwin de Koning

Reputation: 14387

Can I use Client Certificates on Azure App Services without a custom domain?

For testing purposes I would like to enable the 'Incoming Client Certificates' option in my Azure App Service (running a WCF webservice), and see if my Client application can still connect to the webservice. Since I am still in a testing phase, my app service still has the .azurewebsites.net domain name.

However, I can't seem to figure out how to get a proper client certificate that the server will accept (without switching to a custom domain name, which I know will work).

Currently, I see 2 possible routes to a solution:

  1. Somehow get my hands on .cer that is signed by a CA trusted by the App Service server.
  2. Generate a self-signed .pfx and .cer with my own self-signed CA. Import the pfx on the App Service and install the .cer on the client.

Both directions have not yielded any success so far. Does anyone have any experience with this?

Upvotes: 1

Views: 10425

Answers (2)

humblejay
humblejay

Reputation: 347

If the server has requested client certificate in its server hello and the client cert has signing capability, then it is expected to send the CertificateVerify message to the server. It contains signed hash of all messages from Client Hello till that point which are buffered on the server side. The server TLS layer will decrypt this using the client public key (which is in the Client certificate received earlier) and compare with its calculated hash. It will call back to application layer if this fails.

The application needs to handle it at that point and return its own error or continue with the session. https://www.rfc-editor.org/rfc/rfc5246#section-7.4.8

One example of this with Wolfssl library is https://github.com/wolfSSL/wolfssl/blob/14ef517b6113033c5fc7506a9da100e5e341bfd4/wrapper/CSharp/wolfSSL-Example-IOCallbacks/wolfSSL-Example-IOCallbacks.cs#L145

Upvotes: 0

Nancy Xiong
Nancy Xiong

Reputation: 28204

Per my understanding, the client certificate is used by client systems to make authenticated requests to a remote server. In this case, your webservice is the remote server in a C/S mode. As you point out, "validating this certificate is the responsibility of the web app. So this means that any certificate will be valid as long as you don't validate anything". It does not effect on whether you have a custom domain or not in your web app service.

If you want to use client cert authentication with Azure app, you can refer to How To Configure TLS Mutual Authentication for Web App.

Upvotes: 2

Related Questions