app-service-tls-custom-dns

App Service TLS / Custom Domains

What it is

A web app hosted in App Service gets a default Azure domain (e.g. *.azurewebsites.net). For production you bind a custom domain name you own (e.g. www.example.com) and secure it with TLS/SSL so traffic encrypts end-to-end. This note covers mapping a custom DNS name to an app and attaching/serving a TLS certificate on it.

Why it exists

Users expect a branded URL, not a Microsoft-run hostname. TLS (HTTPS) protects data in transit and is a baseline expectation for any public endpoint. App Service makes binding a domain and terminating TLS both configuration-driven — no code changes required.

Key ideas

• Custom domain binding — add your domain in the app’s Custom domains blade, then point your DNS record at the app:
  • A record mapping the domain to the app’s inbound IP address, or
  • a CNAME mapping the subdomain to the app’s default *.azurewebsites.net name.
  • The apex (@) root domain is mapped via an A record; ownership is verified before the app honors the domain.
• TLS/SSL certificate — a digital certificate that binds your domain to a public/private key so HTTPS works.
  • SNI (Server Name Indication) — the modern TLS extension that lets one server/IP host many certificates on different hostnames: the client announces which hostname it wants, and the server replies with the right certificate. App Service is SNI-based, which is why multiple TLS certs can coexist on one app. (Legacy IP-based SSL needed a dedicated IP per certificate and is deprecated.)
• App Service managed certificates — App Service can obtain, configure, and automatically renew a TLS certificate for your custom domain at no cost, without you managing a private key.
• Bring your own certificate — upload your own PFX/PEM certificate + private key and bind it to a domain or slot.
• TLS settings — enforce HTTPS-only (redirect all HTTP to HTTPS) and set the minimum TLS version your clients must use.

Exam facts

• Custom domains are bound in the app; you point DNS (A or CNAME) at the app in your DNS provider or Azure DNS.
• SNI is the mechanism that lets many TLS certificates share one App Service endpoint/IP — the discriminating exam fact vs. old single-IP SSL.
• Managed certificates are free and auto-renewed; a self-uploaded certificate is your job to renew before it expires or HTTPS breaks.

Related

app-service · app-service-plan · app-service-networking · azure-dns · deployment-slots

📘 Source: Microsoft Learn — Add and manage TLS/SSL certificates