Every time I create a new project using Azure Web Apps or even IIS and I need to add a pfx file for end to end https, Cloudflare gives you a private key and certificate but you can't use those directly with Azure Web Apps and I keep forgetting how to do this exactly so as I do sometimes I'm going to post the steps so that it's helpful to others as well as future me.
Downloading origin certificates from Cloudflare
If you want to have Full strict end to end encryption using Cloudflare you need to install a certificate on your origin server
To get this certificate is really easy, from the Cloudflare dashboard Click on SSL/TLS, Origin Server and then Create Certificate.
This will pop a dialog up that will give you some options, Private key type, a list of hostnames that you want the certificate to cover and the certificate Validity for this guide you can leave all the defaults and click Next. The reason it's ok to use the 15 year certificate is because this is effectively a self-signed certificate that only the Cloudflare servers are going to trust and is used for the sole purpose of end to end security, traffic should not be hitting this from anywhere else then Cloudflare, if you feel more comfortable selecting a shorter period you can go ahead, just know you will need to cycle the certificate more frequently. The edge certificate shown to your user will still rotate with a shorter validity period
After having clicked Next you will be presented with the following dialog, create a folder someone easy to navigate to on your machine, I used C:\_tmp\certs
- Make sure PEM (Default) is selected in the droplist
- Save the Origin Certificate contents as the certificate.crt in the folder you created
- Save the Private key contents as the privateKey.key in the folder you created
- Click OK
Now that we have the files on disk we can create our pfx certificate
Installing Ubuntu on Windows
If you are already on linux or already have a flavor of linux installed on your windows machine feel free to skip over this section. The only requirement here is openssl so if you have that through a different way feel free to use that too 😊
Head off to the Windows Store and search for and install the Ubuntu app
This app will require that you have the Windows Subsystem for Linux enabled in Windows Features, if you have not enabled this yet you will be required to reboot your machine after enabling this feature.
After a reboot when you open the app you will see it is initializing and after initialization is complete you will be asked to enter a username and password
You are all set to go, let's get moving with the actual reason for needing this installed 😅
Exporting a pfx certificate using openssl
This process is really quick, all that we need to do is navigate in the shell window to where our certificates are on the windows machine, your drives are mapped under the /mnt/ folder as each letter so to get to my folder from above I need to navigate to /mnt/c/_tmp/certs and then we can run the opensll command in your shell window run the command below, note that when press enter you will be asked for a password for the pfx file and then asked to confirm the password
After this you should be able to run the ls command again and get an output similar to this
You now have a pfx file that you can upload into Azure or use in IIS or any other server that requires a pfx file with a password
Conclusion
Cloudflare is a great platform but when you are not setting up new sites every day or not super familiar with the tools available something as simple as setting up the origin certificate can take slightly longer then what is comfortable so we need cheat sheets like this post 😎
Enjoy and happy encrypted traffic