|
| 1 | +--- |
| 2 | +title: Use Azure App Service Certificate with Azure Front Door |
| 3 | +description: Provides detailed steps to use Azure App Service Certificate together with Azure Front Door. |
| 4 | +author: JarrettRenshaw |
| 5 | +ms.author: jarrettr |
| 6 | +ms.service: azure-app-service |
| 7 | +ms.date: 07/21/2025 |
| 8 | +ms.reviewer: v-liuamson; v-gsitser |
| 9 | +ms.custom: Connection issues with SSL or TLS |
| 10 | +--- |
| 11 | + |
| 12 | +# Use Azure App Service Certificate with Azure Front Door |
| 13 | + |
| 14 | +Microsoft Azure Front Door (Standard and Premium) is a modern global load balancer and application delivery network that supports custom TLS certificates through Azure Key Vault. This article discusses how to use an Azure App Service Certificate securely together with Microsoft Azure Front Door by using managed identities and Bring Your Own Certificate (BYOC) support. This integration enables you to deliver encrypted traffic that has automatic renewal, enterprise-grade performance, and global scale. |
| 15 | + |
| 16 | +## Overview |
| 17 | + |
| 18 | +Azure App Service Certificates provide a simple, integrated way to purchase, provision, and manage SSL/TLS certificates. These certificates are issued by trusted Certificate Authorities (such as DigiCert) and work together with App Services. They can also be extended to secure traffic that's routed through Azure Front Door. |
| 19 | + |
| 20 | +To purchase a certificate, see [Buy and configure an App Service Certificate](/azure/app-service/configure-ssl-app-service-certificate?tabs=portal#buy-and-configure-an-app-service-certificate). |
| 21 | + |
| 22 | +> [!IMPORTANT] |
| 23 | +> After you purchase a certificate, you must manually complete the **Store** step in the **Certificate Configuration** blade to import the certificate into Azure Key Vault. This step is required before the certificate can be used together with other Azure services. |
| 24 | +
|
| 25 | +### Step 1: Enable managed identity on Azure Front Door |
| 26 | + |
| 27 | +A managed identity enables Azure Front Door to securely retrieve the certificate from Azure Key Vault: |
| 28 | + |
| 29 | +1. Navigate to your Azure Front Door profile. |
| 30 | +2. Under **Security**, select **Identity**, and then enable a managed identity: |
| 31 | + - **System-assigned** (Recommended): Tied to the Front Door |
| 32 | + lifecycle |
| 33 | + - **User-assigned** (Optional): For reuse across multiple services |
| 34 | +3. Select **Save**. |
| 35 | + |
| 36 | +For more information, see [Use managed identities to access Azure Key Vault certificates](/azure/frontdoor/managed-identity). |
| 37 | + |
| 38 | +### Step 2: Configure Key Vault Access for Front Door |
| 39 | + |
| 40 | +Grant permission to Azure Front Door to access the certificate by using one of the following methods: |
| 41 | + |
| 42 | +#### Method A: Azure RBAC (recommended) |
| 43 | + |
| 44 | +1. Open **Key Vault** > **Access control (IAM)** > **+ Add** > **Add role assignment**. |
| 45 | +2. Assign the **Key Vault Secrets User** role. |
| 46 | +3. Select **Managed identity**, then select the system-assigned identity of Azure Front Door. |
| 47 | +4. Select **Review + assign**. |
| 48 | + |
| 49 | + ```bash |
| 50 | + az role assignment create \ |
| 51 | + --assignee-object-id <frontdoor-identity-object-id> \ |
| 52 | + --role "Key Vault Secrets User" \ |
| 53 | + --scope "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vault-name>" |
| 54 | + ``` |
| 55 | + |
| 56 | +To retrieve the identity object ID: |
| 57 | + |
| 58 | +```bash |
| 59 | + az front-door show \ |
| 60 | + --name <frontdoor-name> \ |
| 61 | + --resource-group <rg> \ |
| 62 | + --query identity.principalId -o tsv |
| 63 | +``` |
| 64 | + |
| 65 | +> [!NOTE] |
| 66 | +> Make sure that the Key Vault firewall allows trusted services or specific Front Door IP ranges. |
| 67 | + |
| 68 | +#### Method B: Key Vault Access Policy |
| 69 | + |
| 70 | +1. Navigate to your key vault > **Access policies**. |
| 71 | +2. Select **+ Add Access Policy**. |
| 72 | +3. Grant **Get** and **List** permissions for **Secrets** and **Certificates**. |
| 73 | +4. Assign the policy to the managed identity for Azure Front Door. |
| 74 | +5. Save the access policy. |
| 75 | + |
| 76 | +> [!NOTE] |
| 77 | +> This method is suitable for legacy scenarios or if RBAC isn't enabled. |
| 78 | +
|
| 79 | +### Step 3: Add certificate as a secret in Azure Front Door |
| 80 | +
|
| 81 | +Before you do this step, make sure that the App Service Certificate is successfully stored in Azure Key Vault through the App Service Certificate blade. For more information, see [Buy and configure an App Service Certificate](/azure/app-service/configure-ssl-app-service-certificate?tabs=portal#buy-and-configure-an-app-service-certificate). |
| 82 | +
|
| 83 | +To add the certificate: |
| 84 | +
|
| 85 | +1. Go to your Azure Front Door (Standard/Premium) profile. |
| 86 | +2. Under **Security**, select **Secrets** > **+ Add**. |
| 87 | +3. Select your key vault, and then select the stored App Service Certificate. |
| 88 | +4. Select the version. (Use `Latest` to enable automatic certificate rotation.) |
| 89 | +5. Select **Add**. |
| 90 | +
|
| 91 | +> [!NOTE] |
| 92 | +> Azure Front Door supports automatic certificate renewal when you reference the `Latest` version. Updates in Key Vault are reflected in Front Door within 72 hours. For more information, see [Renew customer-managed TLS certificates](/azure/frontdoor/standard-premium/how-to-configure-https-custom-domain?tabs=powershell#renew-customer-managed-tls-certificates). |
| 93 | +> [!IMPORTANT] |
| 94 | +> Certificates must be stored in a Key Vault within the same subscription and must include a complete certificate chain that uses supported algorithms. For more information, see [Use your own certificate with Azure Front Door](/azure/frontdoor/standard-premium/how-to-configure-https-custom-domain?tabs=powershell#use-your-own-certificate). |
| 95 | +
|
| 96 | +### Step 4: Configure a custom domain with BYOC |
| 97 | +
|
| 98 | +1. In your Front Door profile, go to **Domains** > **+ Add**. |
| 99 | +2. Provide the domain details: |
| 100 | + - **Custom domain**: for example, `www.contoso.com` |
| 101 | + - **DNS zone**: Choose Azure DNS, if applicable. |
| 102 | + - **DNS management**: Azure-managed (recommended) or external |
| 103 | +3. Verify domain ownership: |
| 104 | + - Use **TXT record** if you use custom DNS provider |
| 105 | +4. Under **HTTPS Configuration**: |
| 106 | + - **Certificate type**: `Bring Your Own Certificate (BYOC)` |
| 107 | + - **Secret**: Select the secret that you added in Step 3 (for example, `certname-latest`). |
| 108 | + - **TLS policy**: Select a supported policy (for example, `TLS 1.2_2023`) |
| 109 | +5. Select **Add** to finish the setup. |
| 110 | +
|
| 111 | +After verification is made, Front Door serves traffic securely by using the certificate from Azure Key Vault. For more information, see [Add a custom domain in Azure Front Door](/azure/frontdoor/standard-premium/how-to-add-custom-domain). |
| 112 | +
|
| 113 | +## Summary |
| 114 | +
|
| 115 | +| Task | Tool | Notes |
| 116 | +| --- | --- | --- |
| 117 | +| Enable identity | Azure portal or CLI | System-assigned identity is recommended |
| 118 | +| Grant access | IAM Role or Access Policy | Use `Key Vault Secrets User` or equivalent |
| 119 | +| Add secret | Azure portal | Reference `-latest` to enable autorotation |
| 120 | +| Bind domain | Azure portal | Validate domain and configure HTTPS |
| 121 | +
|
| 122 | +## References |
| 123 | +
|
| 124 | +- [Configure HTTPS custom domain (Front Door)](/azure/frontdoor/standard-premium/how-to-configure-https-custom-domain?tabs=powershell) |
| 125 | +- [Add custom domain in Front Door](/azure/frontdoor/standard-premium/how-to-add-custom-domain) |
| 126 | +- [Azure Front Door managed identity access](/azure/frontdoor/managed-identity) |
| 127 | +- [Buy and configure an App Service Certificate](/azure/app-service/configure-ssl-app-service-certificate?tabs=portal) |
0 commit comments