- One of the most important security related tasks
that we have when we manage an Azure environment
is to secure or encrypt the access
to the resources in Azure.
So, since all of our resources are hosted in the cloud,
the access to those resources is very relevant
as it flows through the internet.
Now, a common method, or a very popular method,
of securing the access is encrypting the access.
Now, this is a little bit different than authenticating it.
We've talked already in this course
and will continue to talk about authenticating access
and providing specific users different levels of access.
But here we are talking about encrypting
the access to the content and therefore ensuring
that only users that are allowed to access the resources
can view those resources, or the data
that is being hosted by those resources,
and that any user that is maliciously looking
at the communication from our users,
or our internal network over to the cloud,
will not be able to view any of this information
or data flow.
Now, that encryption is typically done through
TLS, or Transport Layer Security, an implementation
of a HTTPS.
Now, HTTP, the protocol that we use to access website,
can be secured for encrypted communication
as you usually notice if you're accessing
secure websites, such as banking websites,
to perform banking transactions,
all of those transactions and your personal
information is encrypted using HTTPS.
Now, to configure HTTPS in Azure, we need to have
a certificate.
Now, there are some certificates that are built into
Azure that provide built-in HTTPS access to our portal
and, for example, if you notice here
that I'm connected to portal.azure.com
and my entire communication is secure through HTTPS.
That little lock icon shows me that
that connection is secured.
If I click on that lock icon, it provides me
some information about the certificate
that is being used to provide that identification
between my user access, which is authenticated
into the portal.azure website, which is then secured
and communication is encrypted using that certificate.
Now, to load certificates, there are multiple places
that I can do that in Azure, but the most common
or popular, way of managing that HTTPS access,
it used to be through the cloud services
or through the app service plans.
Now, if I click on cloud services, you notice
that it has the word classic next to it,
which means that I created that resource
using the classic portal, or the older Azure portal,
the portal that was available when Azure was first released.
And if I click under this cloud service,
I see that I have a certificate button,
and from the certificate button, I can upload a certificate.
And that certificate will then allow me to encrypt
my communication to this cloud service.
The cloud service was the older way
of managing access to websites.
Today, we talk about websites as being web apps.
And here I see that I have two web apps in my infrastructure
and I can click on 1 of these web apps.
And, to manage the certificates for this web app,
I have to scroll down to SSL settings.
SSL, or Secure Socket Layer, is what provides the
TLS, or the Transport Layer Security, as I mentioned before,
to allow HTTPS.
A lot of acronyms that basically all end or
use the letter S, where they provide
that security access to my website.
So, under the SSL settings, if I scroll down,
I can see that I have here my bindings,
I can add an SSL binding.
Now, to add an SSL binding basically means
that I'm going to bind that name,
or associate that name, with my certificate.
Now, I don't have any certificates here,
but if I had a certificate, I would be able to upload it.
Now, a certificate is typically purchased
from a third party security provider.
These third party providers are entities
that are entrusted with creating these certificates.
The X509 certificates allow us to ensure that
the identity of the website is validated
by a third party entity, which is
entrusted with performing that task.
Now, if you're testing your websites
and you're testing your web apps in Azure,
you can actually create your own certificate.
It's called a self-signed certificate.
It is not a certificate that you can use
with a production website because, in Azure,
it only is supported with the cloudapp.net suffix.
So the domain name cloudapp.net
is owned by Microsoft and you can create a
self-signed certificate, upload it to Azure,
and then test your website.
But your website will only be able to be accessed
using that name, that cloudapp.net name.
If not, of course, you can go ahead and purchase
a certificate from one of the third party providers
and simple internet search will list a number of companies
that offer that services of providing certificates.
Now, I want to point out that these certificates
are used to secure that access in Azure,
but certificates have a number of other usages as well,
one of those you may use in order to access
to your Office365 tenant and manage
the security of your email exchange.
As well, you will use that in order to manage
your devices, if you have an MDM infrastructure,
a Mobile Device Management infrastructure,
and you need to secure the communication
between your devices and your management infrastructure.
So, there are a number of reasons why
you would purchase certificates.
And when you purchase a certificate,
you can actually define the type of usage that
that certificate will have.
Now, I'm just going to show you quickly how
you could create your own certificate by using powershell.
So, there is a powershell cmdlet called
the new-selfsignedcertificate
and I just used tab complete by pressing the
tab button for it to automatically
populate the full powershell command.
And I'm going to use the parameter DNSname,
and DNSname is where I'm going specify the
actual name that my certificate
will be able to be associated with.
Now, remember, if I'm creating a self signed certificate,
it has to be associated with a cloudapp.net name,
so I'm going to call it testwebapp.cloudapp.net,
and there's a number of additional parameters
that I can set, such as whether or not it's exportable,
where the certificate will be stored, and there's
probably about 30 other parameters that
I can set on my self signed certificate.
Now, by default, it stores that certificate
in my local search store on my computer
and I can then export it as a file, save it as a file,
and then upload it into my Azure portal.
As soon as it's uploaded into my Azure portal,
I'll be able to add my binding here.
Now, notice that if I click on Upload,
there's a specific type of file that it's looking for,
so you would have to look for a PFX file.
And the PFX file is the format that
you'd be able to use if you're saving that certificate
as a file from your local store.