{"id":7956,"date":"2019-10-05T11:08:59","date_gmt":"2019-10-05T11:08:59","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/self-sign-certificates-in-azure-app-service-environments\/"},"modified":"2026-11-03T19:29:10","modified_gmt":"2026-11-03T19:29:10","slug":"self-sign-certificates-in-azure-app-service-environments","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/self-sign-certificates-in-azure-app-service-environments\/","title":{"rendered":"Self-sign certificates in Azure App Service environments"},"content":{"rendered":"

Introduction<\/strong><\/p>\n

When deploying Sitecore in to an Azure App Service, you have two options for setting up your search method. The first is method is to use the Azure search, which is integrated into the PaaS Deploy. The other method, and my personal favorite, is to deploy Apache\u00a9 Solr Cloud.<\/p>\n

Using the latter requires us to deploy virtual machines into a virtual network, setting up both an internal load balancer with our Solr nodes in a backend pool and a virtual net integration to connect the Azure Web Apps to the vnet over a point-to-site vpn. Because it is best practice to run Solr Cloud with SSL, we must purchase a publicly signed certificate to have all the nodes and the load
\nbalancer name in the SAN list. We need a publicly signed certificate because Azure App Service does not let you add a public key into the trusted root store. The connection would be untrusted and fail within an App Service web app. With the introduction of Sitecore 9.1.1, we can now deploy into a dedicated Azure App Service Environment (ASE)<\/p>\n

ASE types<\/strong><\/p>\n

There are two types of ASE\u2019s: Public and Internal, and this article focuses on the internal type. An Internal ASE has an internal load balancer that routes requests to the correct web app. The VNET should have a DNS server set with the forward lookup zones that you plan to route into. In my example, I have an Internal ASE with a domain name of azuretestingsite.com<\/strong>. All web apps provisioned into this ASE inherit this domain name, so, if I provision a web app called Jimmy<\/strong>, the URL would be jimmy.azuretestingsite.com<\/strong>. You can assign custom domains to this web app as well, but they cannot overlap with the domain that is used for the ASE.<\/p>\n

Setting it up<\/strong><\/p>\n

Because an ASE is provisioned into a subnet, we can create another subnet in the same vnet to hold our Solr Cloud nodes. Within our DNS server, we can create an A<\/em> record called solrlb.azuretestingsite.com<\/strong>, which routes the Solr requests
\nto the backend nodes. Assuming we configured Solr Cloud with a self-signed certificate for HTTPS, we need to extract the public key and upload it into each web app that makes Solr Cloud calls. Navigate to the SSL Settings<\/strong> of the web
\napp, select the local machine, and upload a public certificate.<\/p>\n

\"mssql<\/p>\n

In the web app App Settings<\/strong>, add a new setting called WEBSITE\\_LOAD\\_ROOT\\_CERTIFICATES<\/strong> and add the thumbprint of the certificate you uploaded. Restart the web app to load it into the trusted root store.<\/p>\n

\"app<\/p>\n

To verify that the certificate is loaded into the trusted root store, log in to KUDU using the publishing credentials of the Azure Web App. Start a powershell prompt within KUDU and type dir cert:\\localmachine\\root<\/em>`. <\/p>\n

\"app<\/p>\n

Repeat the above steps on all the required web apps that need to access Solr Cloud. Log in to the Sitecore management portal and populate the index schema. <\/p>\n

\"solrPopulate\"<\/p>\n

Conclusion<\/strong><\/p>\n

We are now successfully using a self-signed certificate to make an HTTPS connection to Solr Cloud from an Azure Web App. <\/p>\n","protected":false},"excerpt":{"rendered":"

Self-sign certificates in Azure App Service environments<\/p>\n","protected":false},"author":2,"featured_media":7958,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26551","content_type":"blog","created_by":"10130","authored_on":"2024-01-30T12:08:59+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Enhance Azure App Service security with self-signed certificates. Deploy Sitecore securely and communicate through signed certificates.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26551-insights_image-microsoft-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Microsoft Azure, Microsoft Azure Data","product":"Microsoft Azure, Microsoft SQL","publisheddate":"2019-10-05T11:08:59","rxt_solutions":"Data Modernization, Data Strategy & Governance","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Securing Azure App Service Environments with Certificates | Rackspace Technology","field_topics":"","field_slug":"self-sign-certificates-ase","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7956","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7956"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7956\/revisions"}],"predecessor-version":[{"id":9790,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7956\/revisions\/9790"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7958"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}