Custom Domains and SSL Certificates

In this tutorial, you will learn how to configure custom domain names for your App Service and secure them using SSL/TLS certificates. This is a crucial step for providing a professional and secure experience to your users.

Why Use Custom Domains and SSL?

Branding: Use your own domain name (e.g., www.yourcompany.com) instead of the default *.azurewebsites.net.
Trust: SSL certificates encrypt traffic between your users and your application, ensuring data privacy and security.
SEO: Search engines often favor sites with custom domains and HTTPS.

Prerequisites

An Azure App Service instance.
A custom domain name registered with a domain registrar.
Access to your domain registrar's DNS management portal.

Step 1: Map Your Custom Domain to App Service

Before you can bind a certificate, you need to prove ownership of your custom domain. This is done by creating DNS records.

Option A: Using CNAME Record (for subdomains like www)

Log in to your domain registrar's website and navigate to the DNS management section. Create a CNAME record that points your subdomain (e.g., www) to your App Service's default domain (e.g., your-app-service-name.azurewebsites.net).

Type: CNAME
Host/Name: www
Points to/Value: your-app-service-name.azurewebsites.net

Option B: Using A Record (for root domains like yourcompany.com)

For root domains, you'll need to map them to the IP address of your App Service. First, find the IP address of your App Service in the Azure portal (under the "Custom domains" section). Then, create an A record.

Type: A
Host/Name: @ (or leave blank for root domain)
Points to/Value: YOUR_APP_SERVICE_IP_ADDRESS

Additionally, you'll need to create a TXT record to verify domain ownership:

Type: TXT
Host/Name: asuid.www (or asuid for root domain)
Value: YOUR_CUSTOM_DOMAIN_VERIFICATION_ID (found in Azure portal)

After creating the DNS records, allow some time for them to propagate across the internet. You can then go to your App Service in the Azure portal, navigate to "Custom domains," and click "Validate" to check if the domain is recognized.

Step 2: Upload or Purchase an SSL Certificate

You have two main options for obtaining an SSL certificate:

Upload an existing certificate: If you already have an SSL certificate from a third-party provider, you can upload it to your App Service.
Purchase an App Service Managed Certificate: Azure offers free, managed certificates for App Services. These are automatically renewed.

Uploading a Certificate

In the Azure portal, go to your App Service.
Navigate to "TLS/SSL settings."
Under the "Private Key Certificates (.pfx)" tab, click "Upload Certificate."
Provide the PFX file path, password, and a friendly name for the certificate.

Getting an App Service Managed Certificate

In the Azure portal, go to your App Service.
Navigate to "TLS/SSL settings."
Under the "Private Key Certificates (.pfx)" tab, click "Create App Service Managed Certificate."
Select your custom domain from the dropdown.
Click "Create." Azure will provision and renew the certificate automatically.

Step 3: Bind the SSL Certificate to Your Custom Domain

Once your custom domain is validated and your SSL certificate is available, you need to bind them together.

In the Azure portal, go to your App Service and navigate to "Custom domains."
Find your custom domain in the list and click "Add binding."
In the "Add TLS/SSL Binding" pane:
- Select your custom domain.
- Choose your uploaded or managed SSL certificate from the "Certificate (PFX)" dropdown.
- Select the "TLS/SSL Type." For most cases, "SNI SSL" is recommended and supported by all App Service plans. "IP SSL" is an older option that assigns a dedicated IP address.
Click "Add Binding."

Step 4: Enforce HTTPS

To ensure all traffic to your custom domain is secured, enforce HTTPS.

In the Azure portal, go to your App Service.
Navigate to "TLS/SSL settings."
Under the "HTTPS Only" section, toggle the switch to "On."

Tip: After enforcing HTTPS, it's a good practice to update any links in your application or marketing materials to use https:// instead of http://.

Important: DNS propagation can take up to 48 hours, although it's usually much faster. If you encounter issues, wait a bit longer and try validating again. Ensure your DNS records are correctly configured.

Troubleshooting

If your custom domain or SSL binding is not working, consider the following:

DNS Propagation: Use online tools like DNS Checker to verify your DNS records.
Certificate Validity: Ensure your certificate is not expired and matches the domain name.
Binding Type: Confirm you've selected the correct SSL type (SNI SSL vs. IP SSL).
App Service Plan Tier: Custom domains are supported on all App Service plans, but certain SSL features might vary by tier.