13

I need to access a certificate from my Azure Function.

I followed the steps outlined in Runtime error loading certificate in Azure Functions but it didn't work out.

private static X509Certificate2 GetCertificate(string thumbprint, TraceWriter log)
{
    X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
    try
    {
        store.Open(OpenFlags.ReadOnly);
        log.Info("Enumerating certificates");
        foreach (var cert in store.Certificates) {
            log.Info(cert.Subject);
        }
        var col = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
        if (col == null || col.Count == 0)
        {
            return null;
        }
        return col[0];
    }
    finally
    {
        store.Close();
    }
}

Two certificates where uploaded to the Azure Function and the setting WEBSITE_LOAD_CERTIFICATES was added as well and set to either * or to the thumbprint of the required certificate, but to no avail.

The GetCertificate method should print a list of all certificates in the store, but the store is empty.

Any clues on how to solve this?

7
  • did you try searching for a similar problem for webjobs? since the solution would be identical
    – 4c74356b41
    Commented Dec 7, 2016 at 9:31
  • Yes. They all suggest that the approach outlined in the link above should work. But it doesn't. Commented Dec 7, 2016 at 9:33
  • I always use StoreLocation.LocalMachine when I access a cert in azure. I haven't tried in Functions but in other WebApps and CloudService it works with that LocalMachine
    – dave000
    Commented Dec 7, 2016 at 10:03
  • LocalMachine does have a few certificates, however not those I uploaded via the Azure Portal. Commented Dec 7, 2016 at 10:07
  • Okey... I tried and had the same problem. Then tried again, but this time I created the function selecting App Service Plan and not Hosting Plan... and also made sure that when I copy paste the Thumbprint to settings I checked that there are no extra non-printable chars added and I got your code just working!!! Try following the steps and let me know if you succeed!
    – dave000
    Commented Dec 7, 2016 at 10:44

1 Answer 1

8

UPDATE: Client certificates are now supported in the Consumption plan.

Client certificates are not yet supported in our Consumption plan, only in App Service plan. This is tracked by an issue in our repo here. We're working on it - please follow that issue for status. Thanks.

4
  • it seems that it can be done now via Azure Keyvault, uploading a certificate in the Function App and then retrieving the content via a secret in the function
    – Horia Toma
    Commented Mar 12, 2018 at 17:23
  • 3
    It should now be supported in both Consumption and App Service plans. I think the answer should be updated to reflect that. Commented Jul 30, 2018 at 23:32
  • 1
    It works now on consumption plan and also app service and here is my full answer on how to deal with it: stackoverflow.com/questions/53778977/…
    – Marzouk
    Commented Dec 21, 2018 at 15:04
  • 1
    How to find the certificate on LINUX consumption plans? Commented Sep 17, 2020 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.