I want to secure an azure website with a custom domain via SSL. The website is in the "Standard" Tier, as required.

I've been able to upload my self-signed wildcard certificate, but when I want to bind it to the custom domain name, it is not appearing in the "choose a certificate" dropdown.

enter image description here

Does anybody know why this is?


For completeness sake, here's how I generated the self-signed certificate:

  1. Generate a root-certificate makecert -pe -n "CN=Mydomain Root" -ss my -a sha1 -sky exchange -r -len 2048 root.mydomain.com.cer
  2. I imported the root-certificate (right-click -> Install Certificate) after which it ended up in the "Personal" certificate store
  3. Generate a wildcard certificate from the root certificate: makecert -pe -n "CN=*.mydomain.com" -a sha1 -sky exchange -eku -is my -in "Mydomain Root" -sp "Microsoft RSA SChannel Cryptographic Provider" -sy 12 -ss Personal wildcard.mydomain.com.cer
  4. I exported the pfx file of this wildcard certificate with these settings
  5. I uploaded the exported pfx to azure and tried to bind that to my website's custom domain name.

I haven't found a current link for that, but this post on SO suggests that wildcard certificates are not possible (yet) with Azure Websites.

According to this post on Azure Feedback, it should be available on end of april 2014.

Wildcard domain support is live. You can assign a wildcard certificate to your wildcard domain with an SNI SSL binding. Look for IP SSL support at the end of April.

  • I've followed this blog post and according to it, it should work. Please note that in my case I do have a wildcard certificate, but I'm not trying to bind it to a wildcard domain, but rather to a 'normal' domain. Also I'm using SNI SSL binding, not IP. – ldx Apr 24 '14 at 11:33
  • In my specific case, I've got three domains: dev.mydomain.com, qa.mydomain.com and prod.mydomain.com and I'm trying to bind all three of them to a *.mydomain.com certificate. – ldx Apr 24 '14 at 11:37
  • Interesting. Have you uploaded a correct certificate including it's private key? – MichelZ Apr 24 '14 at 11:44
  • I think so, I exported it like this – ldx Apr 24 '14 at 11:50
  • Then unfortunately I'm lost... hope someone else can chime in :) – MichelZ Apr 24 '14 at 11:53

It appears that the azure websites management console only accepts one level of wildcarding. So: web.mydomain.com and db.mydomain.com can both be certified with *.mydomain.com, but for example web.qa.mydomain.com can't, because "web.qa" isn't valid according to the azure websites management console!

Solution? None at the moment, you have to make sure that your website's domain name only needs one part to be wildcarded.

Reference: http://social.msdn.microsoft.com/Forums/windowsazure/en-US/eeeadc3c-2b71-4c31-87aa-780d7c00f20d/cant-use-selfsigned-wildcard-ssl-certificate-in-windows-azure-website-waws?forum=windowsazurewebsitespreview

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.