Azure App Service For Containers SSL Termination

3
votes

Goal: Deploy a website to Azure App Service in a container that works from the php-apache base image as has a custom domain with SSL.

Current Situtation:

  • Website setup to use Dockerfile for building an image
  • Image uploaded to Docker Hub and successfully built
  • Image deployed to Azure App Service as a container
  • Configured custom domain in Azure and pointed DNS to provided IP Address

Problem: How do I configure my container? Currently, I am getting an SSL warning when trying to connect to my website which makes perfect sense as my domain does not match the default certificate azure provides for *.azurewebsite.net (and Azure tells you this when you setup a custom domain, which is neat).

  • Does Azure pass a request made on 443 to my container on 443 requiring me to configure my container for an SSL connection?
  • Does Azure terminate the SSL connection and pass the request to my container on port 80?

I understand I need to upload my certificate to Azure, but if Azure is passing the request to my container on 443, that would mean I would need to setup my container to accept requests on 443 and configure the certificate inside the container (which is fairly trivial). However, if Azure terminates the SSL and passes the request over port 80, then my life is a bit simpler as I can just configure my container to listen on 80 and let Azure do the heavy lifting.

If you have any questions, or need clarification please let me know.

1
azuredockerssl
I uploaded my certificate to Azure today and it worked with my container listening on 80 so it appears they are either terminating the SSL connection or doing some black magic. – ninja coder
it probably is ssl termination. are you able to answer your own question? – Yehuda Makarov
@YehudaMakarov I have not been able to confirm this. I don't know the best way to go about determining an answer. Would I setup my container with the same SSL certificate that I uploaded to Azure or do I remove the certificate from Azure an only leave the cert in the container? – ninja coder
@ninjacoder did you figure it out? I also have similar requirements. Thanks. – Sam

1 Answers

0
votes

From what I can tell, Azure is terminating the SSL connection and passing the request to my container on port 80. I am making this assumption because at this point I am hosting a number of websites in containers and none of them expose 443.

It seems that all that is necessary is to upload your certificate to the Azure App Service Plan and do a bit of configuring to associate it with the correct App Service and website. The container running a website requires no special configuration for SSL.