Exam AZ-204 topic 13 question 2 discussion

Answer: • Generate a certificate • Upload the certificate to Azure key vault • Import the certificate to Azure App Service • Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting https://ankitvijay.net/2021/04/14/certificate-azure-app-service-linux/

1. Generate a certificate. 2. Upload the certificate to Azure Key Vault. 3. Import the certificate to Azure App Service. 4. Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting. Prerequisite: Scale up your App Service plan if your app is in a shared infrastructure tier. https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code#load-certificate-in-linuxwindows-containers

See: https://learn.microsoft.com/en-us/azure/app-service/environment/overview-certificates#private-client-certificate Last box is: "Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting"

My vote: the answer provided is the correct one. https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code

correct https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code#when-updating-renewing-a-certificate

Got this on Dec 16th, 2022. Scored 921 and went with: • Generate a certificate • Upload the certificate to Azure key vault • Import the certificate to Azure App Service • Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting

Answer of Frakadel OK. But otherwise : this is bad practice. Azure Key Vault with managed identity should be used for that purpose.

This is an essay question, but I will bet my time on : Generate Upload to keyvault Import to App service (from keyvault) Add to WEBSITE_LOAD_CERTIFICATES (Important so that it is available in /var/ssl/... or c:\appservies\..\secret path. The code seems to be using that)

Agree to brettusmaximus 1. Generate a certificate 2. Upload to key vault (mandatory security requirements) 3. Import the certificate to Azure App Service. For Linux container, it keeps the private certificates at the location /var/ssl/private and public certificates at /var/ssl/certs. 4. Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting. Refer configure-SSL-CERTIFICATE-IN-CODE

Got this one 01/2022. Went with most voted (to avoid writing answers again)

what a horrible question. Security.cs is not even valid C# and its usage is not even shown in the following snippet that contains the function.

Does the ReadAllBytes method need to specify the file path instead of the directory?

Ok - How does the cert get to be located at the URL (/var/ssl/private)? 1. Generate a certificate 2. Upload to key vault 3. Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting. 4. Add the certificate to Source Control (/var/ssl/private), So when the app deploys it gets there. It doesn't matter about nice error messages.

General information * CryptographicException: The system cannot find the file specified * According to the path we are running a linux container (/var/ssl/private) * Question seems to have a typo (line SC03, ~ is not needed) Answer 1. Generate a certificate 2. Import the certificate to Azure App Service 3. Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting 4. Update line SC05 to include error handling ... Further reading: https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code#load-certificate-in-linuxwindows-containers

So what is the correct answer to this?

1. Generate a certificate 2. Import the certificate to Azure App Service. 3. Add the certificate thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting. https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code#make-the-certificate-accessible 4. Update line SC05 of Security.cs to include error handling and then redeploy the code.

I think it should be 1. Generate Cert 2. Upload to App Service 3. Update config thumbprint value 4. Handle the error in the code gracefully Uploading to Key Vault would offer a better security but another step(s) would be needed it is to add access policy for the App Service to use the Certificate