1

I have created an Azure App Service site which is moving to production.

I am having some problems with the fact that Azure can only handle SSL/TLS for subdomains.

My subdomain www.abc123.com is currently using a CNAME record to point to the App Service, this works well and SSL works flawlessly.

However the apex/naked domain abc123.com can't use a CNAME record as email is handled by gmail and the CNAME root record would interfere with the MX record (?).

I have tried adding an A record for abc123.com to point to my App Service IP address, this forwards traffic but gives an SSL error as Azure requires a CNAME for SSL to function.

I have made a messy workaround which is an A record for abc123.com pointing the IP of an Apache server serving other sites, this server uses the .htaccess to redirect to the www.abc123.com domain.

Is there any way to handle this natively in Azure? Or a service that would perform the same function that my Apache server is doing? Or even a way to add a CNAME and have email still work for the domain?

bendataclear
  • 133
  • 5

2 Answers2

3

A clarification first, App Services do support SSL for apex domains using an A record, however the free certificate offering in app service does not currently support this. You can follow the uservoice item for this here

You can however use an SSL certificate for the apex A record if you supply your own SSL cert, either using an Azure App Service Certificate (this is a separate product in Azure) or purchasing an SSL cert from any other provider and importing this into your app service.

Sam Cogan
  • 38,736
  • 6
  • 78
  • 114
  • Another option for certificates is to use Let's Encrypt. You can generate a free one quite easily. Two catches: 1) You have to authenticate using one of their pre-canned methods. 2) It has to be renewed every 90 days. – Garet Jax Mar 11 '21 at 21:59
  • @GaretJax very true, details on one way to do this are here - https://samcogan.com/lets-encrypt-certificates-in-azure-with-acmebotot/ – Sam Cogan Mar 12 '21 at 13:23
1

Another option is to use a service like http://wwwizer.com/. It performs a naked redirect to www and it has a static IP. I know it isn't great, but it might help you.

Garet Jax
  • 115
  • 5