App Service TLS / Custom Domains
What it is
A web app hosted in App Service gets a default Azure domain such as *.azurewebsites.net. A custom domain maps a name you control, such as orders.northwind.example, to the app. A TLS certificate binding lets browsers validate that name and encrypt the connection to the App Service endpoint.
Why it exists
Users expect a recognizable URL, and HTTPS is essential for internet-facing traffic. DNS proves that the name points to the intended app; TLS proves that the app has a certificate for the name and encrypts the browser-to-service connection. Neither by itself authorizes a user inside the application.
Key ideas
- DNS and ownership: map the custom name using the method App Service requires—often a CNAME for a subdomain or an A record for an apex domain—then complete ownership validation. DNS may be hosted in Azure DNS or another provider.
- Certificate binding: a TLS certificate must cover the custom name and be bound to it. SNI lets the shared endpoint choose the right certificate based on the hostname the client requests.
- Managed certificate: App Service offers a free managed certificate that it renews when its prerequisites remain satisfied. It does not support wildcard domains, private DNS, export, or App Service Environments, and its issuer and key hierarchy can change. Do not use it where certificate pinning is required.
- Other certificate choices: import an App Service certificate, import from Key Vault, or upload a compliant private PFX certificate. With a certificate you manage, renewal and key handling remain your responsibility.
- TLS policy: require HTTPS and choose an appropriate minimum TLS version after confirming client compatibility.
Northwind example
Northwind maps orders.northwind.example to its App Service app, proves ownership, creates a certificate binding, and turns on HTTPS-only. Its staff-only private app uses a different private-DNS design, so it does not assume a free managed certificate will cover it. The TLS lock icon protects the browser connection; Entra sign-in and application roles still decide who can view orders.
Exam facts
- DNS mapping, domain validation, a certificate, and a certificate binding are related but separate configuration steps.
- A certificate encrypts a connection; it does not make an app private or control user permissions.
Related
app-service · app-service-plan · app-service-networking · azure-dns · deployment-slots
📘 Source: Microsoft Learn — Add and manage TLS/SSL certificates in Azure App Service