WCF和Azure：用真实证书替换自签名证书

Question

I've a WCF that runs in Azure as a Cloud Service (with out SSL).

I have implemented on the same project SSL, locally. (with self-sign certificate)

After I experimented locally and saw that everything works well, I purchased real certificate on Go Daddy, now I need to figure out a couple of points:

I saw a couple of articles that shows how to set the configuration of a role in order to publish the WCF to Cloud Service with HTTPS. In those articles they adding the certificate by choosing from the certificates that installed on the computer and then associated the certificate to the HTTPS endpoint.

1. In order to associated certificate to the WCF I must have the certificate installed locally ?
2. There is an "Management Certificate" option on Microsoft Azure Portal under Settings to upload certificates and manage them, Do I need to upload my certificate with this option ?
3. Do I need to installed the certificate manually (like I did with the self-sign cert', configure it in IIS and go to MMC and move the cert to "Intermediate Certificate Authorities" and etc)
4. If I need to do it manually (the answer to question 3 is positive) how can I auto-scale my service? because the process will need to be automated.

Thank you.

Answer 1

Go to your .CSDEF and add these 3 tags (change accordingly):

<WebRole name="CertificateTesting" vmsize="Small">
    ...
    <Certificates>
        <Certificate name="SampleCertificate" storeLocation="LocalMachine" storeName="CA" />
    </Certificates>
    ...
    <Endpoints>
        <InputEndpoint name="HttpsIn" protocol="https" port="443" certificate="SampleCertificates" />
    </Endpoints>
    ...
    <Sites>
        <Site name="Web">
            <Bindings>
                <Binding name="HttpsIn" endpointName="HttpsIn" />
            </Bindings>
        </Site>
    </Sites>
    ...
</WebRole>

Next, open your .CSCFG and add:

<Role name="Deployment">
    ...
    <Certificates>
         <Certificate name="SampleCertificate" thumbprint="9427befa18ec6865a9ebdc79d4c38de50e6316ff" thumbprintAlgorithm="sha1" />
    </Certificates>
    ...
</Role>

Replace thumbprint and thumbprintAlgorithm with the one of your certificate.

Finally use Azure portal to upload the deployment package and the certificate or add it to the certificates tab. You have to export the certificate with the private key in order to work.

More details on this link: http://azure.microsoft.com/en-us/documentation/articles/cloud-services-configure-ssl-certificate/

Answering you last question: As you've upload the certificate with the package, auto scale will use this package to provision the new servers.