Edit

Configure HTTPS on an Azure Front Door (classic) custom domain

Applies to: ✔️ Front Door (classic)

Important

Azure Front Door (classic) retires on March 31, 2027. Because the service is retiring, it no longer supports profile creation, new domain onboarding, or managed certificates. To avoid service disruption, ⁠migrate to Azure Front Door Standard or Premium. For more information, see ⁠Azure Front Door (classic) retirement.

This article explains how to enable HTTPS for a custom domain associated with your Front Door (classic). Using HTTPS on your custom domain (for example, https://www.contoso.com) ensures secure data transmission through TLS/SSL encryption. When a web browser connects to a website by using HTTPS, it validates the website's security certificate and verifies its legitimacy, providing security and protecting your web applications from malicious attacks.

Azure Front Door supports HTTPS by default on its default hostname (for example, https://contoso.azurefd.net). However, you need to enable HTTPS separately for custom domains like www.contoso.com.

In this tutorial, you learn how to:

  • Enable HTTPS on your custom domain.
  • Use your own TLS/SSL certificate stored in Azure Key Vault.
  • Disable HTTPS on your custom domain.

Prerequisites

  • An Azure account with an active subscription. Create an account for free.

  • An Azure Front Door with at least one custom domain onboarded. For more information, see Add a custom domain to your Front Door.

  • Azure Cloud Shell or Azure PowerShell to register Front Door service principal in your Microsoft Entra ID.

    The steps in this article run the Azure PowerShell cmdlets interactively in Azure Cloud Shell. To run the cmdlets in the Cloud Shell, select Open Cloud Shell at the upper-right corner of a code block. Select Copy to copy the code and then paste it into Cloud Shell to run it. You can also run the Cloud Shell from within the Azure portal.

    You can also install Azure PowerShell locally to run the cmdlets. If you run PowerShell locally, sign in to Azure by using the Connect-AzAccount cmdlet.

TLS/SSL certificates

Azure Front Door uses Server Name Indication (SNI) TLS/SSL. To enable HTTPS on an existing Front Door (classic) custom domain, use your own TLS/SSL certificate through an integration with Azure Key Vault. Ensure your certificate is from a Microsoft Trusted CA List and has a complete certificate chain.

Prepare your key vault and certificate

  1. Create a Key Vault account in the same Azure subscription as your Front Door.
  2. Configure your key vault to allow trusted Microsoft services to bypass the firewall if network access restrictions are enabled.
  3. Use the Key Vault access policy permission model.
  4. Upload your certificate as a certificate object, not a secret.

Note

Front Door doesn't support certificates with elliptic curve (EC) cryptography algorithms. The certificate must have a complete certificate chain with leaf and intermediate certificates, and root CA must be part of the Microsoft Trusted CA list.

Register Azure Front Door

Register the Azure Front Door service principal in your Microsoft Entra ID by using Azure PowerShell or Azure CLI.

Use the New-AzADServicePrincipal cmdlet to register the Front Door service principal in your Microsoft Entra ID.

New-AzADServicePrincipal -ApplicationId "ad0e1c7e-6d38-4ba4-9efd-0bc77ba9f037"

Grant Azure Front Door access to your key vault

  1. In your key vault account, select Access policies.

  2. Select Create to create a new access policy.

  3. In Secret permissions, select Get.

  4. In Certificate permissions, select Get.

  5. In Select principal, search for ad0e1c7e-6d38-4ba4-9efd-0bc77ba9f037 and select Microsoft.Azure.Frontdoor. Select Next.

  6. Select Next in Application.

  7. Select Create in Review + create.

Note

If your key vault has network access restrictions, allow trusted Microsoft services to access your key vault.

Select the certificate for Azure Front Door to deploy

  1. Return to your Front Door in the portal.

  2. Select the custom domain for which you want to enable HTTPS.

  3. Under Certificate management type, select Use my own certificate.

  4. Select a key vault, secret, and secret version.

    Note

    To enable automatic certificate rotation, set the secret version to Latest. If you select a specific version, you must manually update it for certificate rotation.

    Warning

    Ensure your service principal has GET permission on the Key Vault. To see the certificate in the portal drop-down, your user account must have LIST and GET permissions on the Key Vault.

Wait for propagation

After you save the HTTPS configuration, it can take up to 6-8 hours for the custom domain HTTPS feature to activate. When complete, the custom HTTPS status in the Azure portal is set to Enabled.

Clean up resources

To disable HTTPS on your custom domain:

Disable the HTTPS feature

  1. In the Azure portal, go to your Azure Front Door configuration.

  2. Select the custom domain for which you want to disable HTTPS.

  3. Select Disabled and select Save.

Wait for propagation

After disabling the custom domain HTTPS feature, it can take up to 6-8 hours to take effect. When complete, the custom HTTPS status in the Azure portal is set to Disabled.

Operation progress

The following table shows the operation progress when disabling HTTPS:

Operation progress Operation details
1. Submitting request Submitting your request
2. Certificate deprovisioning Deleting certificate
3. Complete Certificate deleted

Next step

Set up a geo-filtering policy

  • Last updated on