2

I have a Java Spring Boot web application deployed on an Azure App Service (not embedded Tomcat, but using App Service Tomcat PaaS). This application needs to make a call to a REST API, that is secured by mandating mutual authentication, i.e. with a client certificate.

I have the PFX file, and I don't have access to the environment to add the certificate to the keystore, truststore, etc.

Is there any way to call the REST API in Java, with just the client certificate, which possibly is part of the web application resources (or retrieved from KeyVault)?

Web User
  • 7,438
  • 14
  • 64
  • 92

1 Answers1

1

I have the PFX file, and I don't have access to the environment to add the certificate to the keystore, truststore, etc.

Per my understanding, for using SSL certificate in Azure App Service, you could try to follow the steps below:

1) Click "SETTINGS > SSL settings" of your web app, then click Upload Certificate for uploading your certs.

2) Add a seting named WEBSITE_LOAD_CERTIFICATES with the value equals to the thumbprint of your certificates which would be accessed by your application code. Also, you could just load certificate as a file in your code. Details you could follow Use an SSL certificate in your application code in Azure App Service.

Moreover, if the above approach could not meet your requirement, you may use Azure Key Vault as your cert store. For a simple way, you could add your certificates via Azure Portal, details you could follow here. For retrieving your certificate in your code, you could follow Authentication samples for Azure Key Vault using the Azure Java SDK for authenticating to your key vault and retrieve your certificate.

Bruce Chen
  • 18,207
  • 2
  • 21
  • 35
  • Thanks for the suggestions. I can either add the client certificate in SSL Settings, or access then from the Key Vault. My question was Java specific; following the links shows me how to load the certificate which is still insightful information, but it is not telling me how to use that certificate to make a HTTP call. The examples I have encountered on this topic seem to rely loading the certificate from the keystore, and that is what I am not able to translate for my use case, of getting from a file, or keyvault or from SSL Settings. – Web User Jun 30 '18 at 15:24