How to configure SSL on a self hosted Web API in Azure Service Fabric

6
votes

I have followed this article to setup an OWIN self hosted Web API within an Azure service fabric stateless service.

I also found this article which describes setting up an HTTPS endpoint within an Azure service fabric service.

  ...
  <Certificates>
    <EndpointCertificate Name="TestCert1" X509FindValue="FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF F0" X509StoreName="MY" />  
  </Certificates>
  ...

How do I configure the SSL certificate for my WebAPI service within service fabric? When I access my service fabric cluster in the Azure portal, the "Certificate" textboxes are greyed out.

In other Azure services their is typically a area to upload certificates which can then be referenced by the application.

Do I need to manually include my certificate in the service fabric package and install it into the certificate store before it can be referenced?

In addition does azure provide a HTTPS cert for *.cloudapp.azure.com that can be used during development?

1
asp.net-web-apiasp.net-web-api2owinazure-service-fabric
Isn't this the one? azure.microsoft.com/en-us/documentation/articles/… – Lex Li
Thanks - I will reivew. – Wallace Breza

1 Answers

11
votes

To secure an OWIN Self-Hosted API in SF with SSL, you can follow the different scripts and example config I've compiled:

https://gist.github.com/andersosthus/c483eaf8630219c789de

The basic flow goes like this:

  1. Upload a certificate to KeyVault (uploadCertToKeyVault.ps1)
  2. Install the certificate to your SF VMs (installCertOnVm.ps1)
  3. Configure the Endpoint section of your ServiceManifest
  4. Configure the ManifestImport and Policy section of your application manifest

Step 1 & 2 can be skipped, but then you need to log in to each VM and install the certificate manually.

For VMSS: To install certificates from KeyVault onto a VMSS with ARM, do the following: In your VMSS template, under the OSProfile section, there is section called secrets. Here you can configure the sourcevault and add certificates to be installed.

This works like all other ARM templates. You can add a certificate to this list at a later point and redeploy the template. The certificate will then be installed on your VMSS.