Certificate for Azure application

Question

I'm trying to create a https endpoint on my azure application, but I've run into a problem. I have a CNAME record (in our local ISP's Name Server), like MyApp.MyDomain.com, which maps to MyApp.cloudapp.net.

Microsoft documentation tells me that I need to get a Certificate Signing Request (CSR) for MyApp.MyDomain.com. However, the only place this exists is in the local ISP's name server, and they tell me that they can't create this CSR since they don't host that domain. This doesn't make sense to me, since nobody "hosts" that domain, it's just a CNAME.

So I don't know who can create that CSR. Is it something I can do locally (i.e. on an IIS that is unrelated to that domain), or does it need to be done on Azure's / local ISP's server?

Answer 1

You can do this locally and you'll send it to the company you buy the certificate from (let's say Comodo). Once they're done, they'll send the response and you'll need to upload it in IIS (under Server Certificates, Complete Certificate Request).

The result will be that you'll have a PFX file (a file with public and private key). Once you have this file you'll need to upload it in the Windows Azure Portal, and in your WebRole you'll need to fill in the thumbprint of that certificate.

Once you've done all this and you deployed the application, you'll be able to access the website through HTTPS and you'll see that the certificate will be used correctly.