1

I have a site in Azure. Pages are generated by Azure Functions, but for a given URL generated page will always be identical, so I put it behind a CDN endpoint. I added custom domains to the endpoint: www.example.com is the main domain and there is also a naked domain version example.com, but any request to it is redirected to the www.example.com. Any http requests are also redirected to https. Both redirects are performed by returning redirect result from Azure Function.

enter image description here

So, both http://example.com and http://www.example.com properly redirected to https://www.example.com. The problem arises if someone tries to access https://example.com. The certificate served for this url is *.azureedge.net and the browser predictably displays a warning message (if instructed to proceed - it receives a redirect and works fine after that).

When I try to enable Custom HTTPS on example.com - I get an error Enabling Https with CDN Managed Certificate is not supported anymore for apex (root) domains.

Is there any way I can fix this, perhaps instruct a redirect from example.com to www.example.com on DNS level? I've seen suggestions to use alternative CDNs available in Azure, but I'm not ready to go down that route yet.

Ivan Koshelev
  • 3,830
  • 2
  • 30
  • 50

1 Answers1

2

As you've discovered, as of April 2021 Managed certificates are not supported on Apex domains. The only supported way to get round this at present is to upload your own certificate (either free or purchased) or purchase one through KeyVault.

Having said that, Jack Tracey has put together a list of instructions to achieve this in an unsupported manner.

Matthew Steeples
  • 7,858
  • 4
  • 34
  • 49
  • I recommend https://github.com/shibayan/keyvault-acmebot for generating the certs for free with acme (as opposed to Microsoft's $60 per certificate, the FAQ says this costs $0.01 to host). Follow the setup instructions in the wiki and remember to set the Function App settings it tells you (especially in regards to setting the DNS integration-related settings). –  Mar 27 '22 at 14:37