8

I have an Azure Web Site running successfully for the last year over SSL. The certificate is expiring, so I purchased a renewal. The steps I followed were:

  1. use IIS to create the CSR

  2. download the PKCS7 package (which includes intermediate certificates) from GeoTrust

  3. complete the certificate request in IIS

  4. use the certmgr MMC snap-in to export the PFX file with a private key and including all intermediate certificates and extended properties

  5. upload to Azure

I am getting an error from Azure on step 5 - "Could not upload the certificate for web site XYZ." And the expanded error detail is "At least one certificate is not valid (Certificate failed validation because it could not be loaded.)"

4
  • 4
    This question appears to be off-topic because it is not about programming. See What topics can I ask about here in the Help Center. Perhaps Server Fault, Webmaster Stack Exchange or Web Apps Stack Exchange would be a better place to ask.
    – jww
    Jul 5, 2014 at 2:56
  • @jww if it's in the context of setting up a website for development, then I'd say it's on-topic for Stack Overflow, but if it's a production website, then I'd say that it belong on Server Fault.
    – user456814
    Jul 5, 2014 at 3:57
  • 1
    Thanks @Cupcake. Its not clear to me how an Azure configuration problem is on-topic at Stack Overflow. There are other stack exchanges for the topic. Perhpas Stack Overflow should merge with the other sites (like Super User, Web Apps, Web Masters and Server Fault) so all the questions can be asked at Stack Overflow.
    – jww
    Jul 5, 2014 at 4:13
  • 2
    Microsoft actually asks users to post questions here and tag them with Azure (azure.microsoft.com/en-us/support/forums). Perhaps you should contact them and ask them to monitor a different forum instead. From the upvotes on the question, it appears several SO users are having similar issues and are coming to SO for a solution. I would argue this question falls clearly under the topic "software tools commonly used by programmers".
    – maxmoore14
    Jul 5, 2014 at 15:49

2 Answers 2

6

Update: Azure support notified me on 2014/07/07 that the issue described below has been fixed.


I contacted Azure support and they confirmed that this is a known issue with the service. According to the tech I spoke to, a fix should be deployed some time next week.

In the meantime, I was provided with the following workaround:

While exporting the certificate, uncheck the following boxes:

  • Include all certificates in the certificate path if possible
  • Export all extended properties
4
  • been fighting with this for a couple of days, thanks for sharing. I am using openssl to generate the pfx, so will have to figure out how to omit those properties at the command line
    – Baldy
    Jul 4, 2014 at 7:40
  • 2
    Yes, this works, but see my comment on Martin's answer. Your SSL chain will break in browsers that don't have the intermediate certificates. Would you do us all a favor and post here when you get word from Azure that the issue is resolved?
    – maxmoore14
    Jul 4, 2014 at 15:59
  • @maxmoore14 Thanks for pointing that out. I'll do that. Jul 4, 2014 at 16:39
  • 2
    Just tested again now. The issue appears to have been resolved by Azure.
    – maxmoore14
    Jul 7, 2014 at 17:24
5

Having just received the error as described (with a COMODO wildcard certificate) I tried NOT including the intermediate certificates when exporting the .pfx cert file and -- low and behold -- Azure accepts the certificate upload.

This goes contrary to the Azure docs, but initial testing of the https URL in Firefox, IE and Chrome doesn't show any problems.

1
  • 1
    Yes, I can confirm this worked for me as well. The problem is though if you run into a browser that doesn't have the intermediate certificates (in your case, from COMODO) then your certificate chain will break.
    – maxmoore14
    Jul 4, 2014 at 15:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.