AZ-104 Question 181
Single answerYou manage an Azure App Service hosting a web application on a custom domain. You have obtained a wildcard SSL certificate from a trusted third-party Certificate Authority and want to secure the main domain and subdomains. Which action must you perform to configure TLS with your wildcard certificate in Azure App Service?
- A
Generate a .cer file from the wildcard certificate and upload it to the App Service under TLS/SSL settings without a private key
- B
Import the wildcard certificate as a .pfx file under TLS/SSL settings and create an SNI SSL binding for the custom domain
- C
Install the wildcard certificate on your local machine, convert it to .pem, and manually add it to the App Service's App Settings
- D
Use the Azure Cloud Shell to run a PowerShell script that uploads only the public key portion of the certificate, then bind your domain
Show answer and explanation
Correct answer: B
Explanation
In Azure App Service, to secure a custom domain with a wildcard SSL certificate, the certificate must be uploaded as a .pfx file (public and private key) and bound to the domain using an SNI SSL binding. This ensures that both the main domain and subdomains are protected by the wildcard certificate.
- A. Incorrect.
A .cer file alone does not include the private key, meaning it cannot be used to establish secure TLS bindings in Azure App Service.
- B. Correct.
You must upload the .pfx file containing both public and private keys under TLS/SSL settings and then configure SNI SSL bindings for the custom domain to enable secure connections.
- C. Incorrect.
Simply converting the file to .pem and adding it to App Settings does not configure the App Service to handle TLS for custom domains.
- D. Incorrect.
Azure App Service requires the full certificate (public and private key) set within its TLS/SSL settings, not just the public key uploaded via script.