2

I'm trying to use https://mysite.trafficmanager.net that should resolve to https://myfunction.azurewebsites.net without adding my own SSL cert or domain.

When I go directly to https://myfunction.azurewebsites.net the cert is valid, but when I go to https://mysite.trafficmanager.net I get a cert error saying the cert is issued to *.azurewebsites.net

Do I have to purchase my own SSL to get this to work? It seems like the certs should just work within the Azure family and that I'm just missing a configuration setting.

Rusty Divine
  • 3,462
  • 1
  • 21
  • 15

1 Answers1

3

You get a cert error since myfunction.azurewebsites.net have a certificate for *.azurewebsites.net but not *.trafficmanager.net so traffic manager site is not secured unless you have a custom domain + SSL cert.

The azure traffic manager works at DNS level. This means that it does not handle any request, just making the right redirection. The clients connect directly to the selected endpoint, not through Traffic Manager.

If you want to access the endpoint via HTTPS, you just need to bind an SSL certificate on your endpoint. If you want this error to disappear, you can read this Azure networking feedback.

For a dev\test scenario, there are a couple options you may want to consider:

  1. Buy a real cert and domain/sub-domain for your dev-test setup.
  2. Create a self-signed certificate for your site with the *.trafficmanager.net SAN added to it and install this self-signed cert to the Trusted Certificate Authorities store on your clients to not get browser warnings.
Nancy
  • 26,865
  • 3
  • 18
  • 34
  • Thanks - the Azure networking feedback link was really helpful: "The team considered this ask and we have decided to not implement it. It is not considered security best practice to add wildcard SANs to certificates for a different service. It is assumed that you have both a custom domain and the proper SSL certificate for use with the TrafficManager scenario." – Rusty Divine Dec 18 '18 at 17:50
  • For anyone else stumbling onto this, you can get free SSL from https://letsencrypt.org/ and add that to your custom domain. – Rusty Divine Dec 18 '18 at 19:04