AZ-104 Microsoft Azure Administrator Exam

Implement and Manage SSL/TLS Certificates

SSL/TLS certificates are crucial tools for securing communication between clients and Azure App Services. These certificates help ensure data integrity and client data privacy by encrypting information transmitted over the internet. The following sections detail how to configure and manage these certificates effectively for your Azure App Services.

Configure TLS Mutual Authentication

Mutual authentication is a process whereby both the server and client verify each other's certificates. Implementing this involves configuring your app to handle Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protocols. To maintain security, your application should be set up to process client certificates correctly and only accept HTTPS requests, ensuring all data exchanged is encrypted and secure.

Prepare Your Web App

Before you can configure custom TLS/SSL bindings or enable client certificates, your web app must be hosted on an appropriate App Service plan. Ensure it is in the Basic, Standard, Premium, or Isolated tiers rather than the F1 or D1 tiers. If you find your app on a free tier, it's essential to scale up to a coefficient level like B1, B2, or B3. This can be achieved by navigating to App Services in the Azure portal, selecting your web app, and verifying the pricing tier.

Enable Client Certificates

When you enable client certificates, it's crucial to choose the right client certificate mode based on your security needs:

• Required mode ensures every request includes a client certificate.
• Optional mode prompts users to provide a certificate but does not enforce it.
• Optional Interactive User mode allows requests with a client certificate but does not prompt users by default.

Choosing the right option helps you balance security requirements with user convenience.

Enable HTTPS for Custom Domains

Securing a custom domain with HTTPS involves several essential steps:

1. Add the binding: Navigate through the Azure portal to App Services > > Custom domains and select Add binding.
2. Select a certificate: You have options such as creating a managed certificate, importing an App Service certificate, uploading a .pfx file, or importing from the Key Vault.
3. Choose TLS/SSL type: Opt for SNI SSL, which accommodates multiple domains on a single IP, or choose IP-based SSL for a dedicated IP address.

Create a Free Managed Certificate

Azure provides a free managed certificate option for securing custom DNS names. While it's automatically managed and renewed by Azure, this type of certificate comes with a few limitations:

• It does not support wildcard certificates.
• It's non-exportable, meaning it cannot be shared outside its assigned environment.
• It restricts domain names to alphanumeric characters, dashes, and periods.

Upload a Private Certificate

To upload a private certificate, you should follow these steps:

1. Merge intermediate certificates: Combine them into a singular file.
2. Export to .pfx: Use OpenSSL to export the merged certificate along with its private key.
3. Upload to App Service: Access the Azure portal, go to App Services > > Certificates, and upload your certificate using the Upload (.pfx) certificate option.

By implementing these practices and maintaining your certificates effectively, you ensure security and uphold data integrity in your Azure App Services communications. This approach helps safeguard against cyber threats while giving your users the peace of mind that their information remains private.