Using Certificates in Azure App Services

In different kind of situations you need to use a certificate for authentication or signing. I needed on because I was setting up a Identity Server the Identity Server V3 (https://identityserver.io) to be exact.

Within this Identity Server a certificate is used for signing. For testing purposes you can download one from their GitHub repository. But if you would like to buy one or generate one you will have to do some extra work.

If you want to generate a certificate you can read my post from last week:

The certificate that’s needed can be saved within the application or a more manageable solution by saving it within Azure.

On a blog page from Microsoft I found out how you can save the certificate within Azure and use it with your application. As this is a guide made with the old portal I rewrote the guide with steps that need to be down within the new Azure portal (https://portal.azure.com).

Upload the Certificate

The first step is to upload the certificate. To accomplish this follow the following steps:

  1. Open the Azure portal: https://portal.azure.com
  2. Navigate to your created Azure App Service for example a Azure Web App.
  3. In the menu blade pick the option “SSL Certificates” under the “Settings” section.image
  4. In the SSL Certificates blade upload your certificate and supply the password.image

Adjusting the Web App Settings

When the certificate is uploaded the Web application it self needs to be instructed to load the certificate. This can be done by adding a application settings called “WEBSITE_LOAD_CERTIFICATES” and adding the thumbprint of the certificate you want to be loaded as the value. If you want to load multiple certificates you need to supply the value as a comma-separated list.

  1. Open the Azure portal: https://portal.azure.com
  2. Navigate to your created Azure App Service for example a Azure Web App.
  3. In the menu blade pick the option “Application Settings” under the “Settings” section.
  4. In the newly opened blade scroll down to the section called “App Settings” and add the settings.


Before publishing your application to the cloud you can also add the value to your web.config.

<add key="WEBSITE_LOAD_CERTIFICATES" value="2697505afae56f3ac23a53716d2ff3029903d542"/>

Load the certificate within your application

With the previous steps done you are able to load the certificate within the application. By simply adding the following C# method:

public X509Certificate2 GetCertificate(string thumbprint) {

    if (string.IsNullOrEmpty(thumbprint))
        throw new ArgumentNullException("thumbprint", "Argument 'thumbprint' cannot be 'null' or 'string.empty'");

    X509Certificate2 retVal = null;

    X509Store certStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);

    X509Certificate2Collection certCollection = certStore.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);

    if (certCollection.Count > 0) {
        retVal = certCollection[0];


    return retVal;

This method can simply be called by supplying the thumbprint of the certificate that you for example have saved within the web.config/ app settings.

//load the thumbprint from the web.config
string thumbprint = WebConfigurationManager.AppSettings[WebConfigurationKeys.Thumbprint];
X509Certificate2 identityCertificate = GetCertificate(thumbprint);

My complete test application for Identity Server V3 with the Azure certificate implementation can be found on GitHub:

The complete solution can be hosted within a Azure Web App Instances but preferable within a Azure App Service Environment. This is because a Web App instances is a shared resource on a VM witch is not a good security practice for a Identity Server, so deploying it to a Azure App Service environment is preferable as this is not a shared environment.

Related Posts

Azure DevOps Automation A couple of weeks ago the rename / rebranding of Visual Studio Team Services to Azure DevOps was announced. The rebranding is a great step forward int...
AKS (Kubernetes) and no connection could be made because the target machine acti... A client of my had an error while connecting to different resources within their Kubernetes cluster in Azure (AKS). Kubectl error On the kubectl com...
Kubernetes (AKS) attached to Azure Storage (Files) Kubernetes (AKS) can be used for many situations. For a client we needed to make files available trough a Kubernetes Pod. The files needed to be share...
Resource Group deployment via ARM templates When deploying an Azure Resource Manager (ARM) template you have to create a resource group within Azure. To deploy a template via script your script ...
Azure Managed Service Identity and Local Development Instead of storing user credentials of an external system in a configuration file, you should store them in the Azure Key Vault. Before MSI (Managed S...
The securitydata Azure resource group Most of the times companies have rules in place for managing their Azure environment. The main rules that should be in place are “Azure Policies” and ...


  1. We’re implementing the same exact thing in Azure App Service, IdtSrv3. We’ve been having some trouble figuring out how we were going to load in the cert, then we found your blog here. We followed the steps you gave, but we are seeing the below error being thrown. Any ideas?

    System.InvalidOperationException: IDX10614: AsymmetricSecurityKey.GetSignatureFormater( ‘http://www.w3.org/2001/04/xmldsig-more#rsa-sha256’ ) threw an exception.
    Key: ‘System.IdentityModel.Tokens.X509AsymmetricSecurityKey’
    SignatureAlgorithm: ‘http://www.w3.org/2001/04/xmldsig-more#rsa-sha256′, check to make sure the SignatureAlgorithm is supported.
    Exception:’System.Security.Cryptography.CryptographicException: Invalid provider type specified.

    at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer)
    at System.Security.Cryptography.Utils.GetKeyPairHelper(CspAlgorithmType keyType, CspParameters parameters, Boolean randomKeyContainer, Int32 dwKeySize, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle)
    at System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair()
    at System.Security.Cryptography.RSACryptoServiceProvider..ctor(Int32 dwKeySize, CspParameters parameters, Boolean useDefaultKeySize)
    at System.Security.Cryptography.X509Certificates.X509Certificate2.get_PrivateKey()
    at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.get_PrivateKey()
    at System.IdentityModel.Tokens.X509AsymmetricSecurityKey.GetSignatureFormatter(String algorithm)
    at System.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(AsymmetricSecurityKey key, String algorithm, Boolean willCreateSignatures) in c:\workspace\WilsonForDotNet45Release\src\System.IdentityModel.Tokens.Jwt\AsymmetricSignatureProvider.cs:line 147’.
    If you only need to verify signatures the parameter ‘willBeUseForSigning’ should be false if the private key is not be available. —> System.Security.Cryptography.CryptographicException: Invalid provider type specified.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.