2

I have deployed Sitecore 9.0.2 XP Single in an Azure App Service Environment (ASE). After deployment I keep seeing the following error being reported in the log files:

Exception: System.InvalidOperationException
Message: **The certificate was not found**.
Source: Sitecore.Xdb.Common.Web
   at Sitecore.Xdb.Common.Web.CertificateWebRequestHandlerModifier.Process(HttpClientHandler handler)
   at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.CreateRequestHandler()
   at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.CreateClient()
   at System.Lazy`1.CreateValue()
   at System.Lazy`1.LazyInitValue()
   at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.d__37.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Sitecore.Xdb.Common.Web.CommonWebApiClient`1.d__32.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Sitecore.XConnect.Client.WebApi.ConfigurationWebApiClient.d__4.MoveNext()

I used these Quickstart templates that Sitecore provides on Github, and only modified them slightly to allow the use of the ASE.

I generated a self-signed client certificate. In the ARM template parameter file I used the 'allowInvalidClientCertificates' parameter and set it to 'true'. I see that the certifcate has been processed during the installation. The Resource Group contains an object of type Microsoft.Web/certificates. I also see that the Web.config file contains the following line:

<add key="AllowInvalidClientCertificates" value="True" />

The ConnectionStrings.config contains entries listing the certificate thumbprint. As suggested in this stackexchange thread, I added "AllowInvalidClientCertificates=true" to the connection string. But that didn't solve the problem.

<add name="xconnect.collection.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=DUMMYTHUMBPRINT;AllowInvalidClientCertificates=true" />
<add name="xdb.marketingautomation.operations.client.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=DUMMYTHUMBPRINT;AllowInvalidClientCertificates=true" />
<add name="xdb.marketingautomation.reporting.client.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=DUMMYTHUMBPRINT;AllowInvalidClientCertificates=true" />
<add name="xdb.referencedata.client.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=DUMMYTHUMBPRINT;AllowInvalidClientCertificates=true" />

Any suggestion would be highly appreciated that could lead to a solution. Many thanks in advance.

3

Answering my own question here. Not for points but in case someone else runs into the same problem.

It turns out the error message "The certificate was not found" doesn't refer to the Sitecore client certificate, but refers to the SSL server certificate that was configured on the ASE. Let me explain further.

We deployed an Internal ASE (ILB) and configured it with a non-public Top Level Domain. We also configured a self-signed certificate on the ASE, because you can only request valid 3rd party certificates for public TLD's. Using an SSL certificate from an internal CA wasn't possible, because you cannot simply import the root cert from the CA in a Web App's certificate store, like you do on a Windows server. At least, not that I am aware of.

The SSL certificate you configure on an ASE gets configured on the load balancer of that ASE. All traffic to Web Apps flows through the ASE load balancer. This also applies for Web Apps that communicate which each other that live inside the same ASE. In our situation, Sitecore CD wants to communicate to the xConnect Web App, then hits the load balancer that presents the self-signed SSL certificate. And apparently, Sitecore doesn't like self-signed SSL certificates. And there's no way I found to let Sitecore ignore invalid or invalid certificates, like with a web browser.

The solution was easy. We configured the Web Apps with hostnames (URL's) using a valid TLD and configured a 3rd party issued SSL certificate. As a last step we changed configuration of the ConnectionStrings.config to reflect the new hostnames. That's it. The errors disapeared from the logging and we are able to successfully use xConnect.

  • Hey Richard- Just to clarify, what version Sitecore 9 are you using? I was not aware that Sitecore actually supports ASE. It was something that was revealed with 9.1 – Justin Bradley Dec 11 '18 at 19:25
  • 1
    We are using Sitecore 9.0.2. I believe the ASE was already supported. Sitecore support never mentioned that it wasn't supported. They just didn't provide any ARM templates for it. But I could be wrong here. – Richard Waal Dec 12 '18 at 5:48
  • Was told by SC that is was not supported when we were considering it. I know it is possible with modification of ARM templates and I am aware that in external ASE you can actually clone the app service without the use of an ARM template. Supposedly 9.1 is first release that actually supports ASE - I saw it in the release notes, but then it disappeared. Asked SC about why -they told me it will be documented and supported with the next 9.1 update. That is the only reason I mentioned. Regardless, good luck with your solution! – Justin Bradley Dec 18 '18 at 23:44
1

In your Azure Portal, select your web app running the site.

Go to the SSL Settings blade, and in the Private Certificates tab check whether you've got the xConnect client certificate installed there, and whether that thumbprint matches what you have in your config settings.
(If the certificate doesn't show here it needs to be uploaded first)

If that's the case, open the Advanced Tools (should have a link that opens in a new tab), where you can select Debug console -> PowerShell. In the PowerShell console, type

Get-ChildItem -path cert:\CurrentUser\My

See if your certificate appears there.

If that's not the case, go back to your web app, go to Application Settings and add the setting WEBSITE_LOAD_CERTIFICATES with the value of either the thumbprint or (if you have more certificates) the value *: enter image description here

  • The certificate was not listed in the SSL Settings blade, in the Private Certificate tab. So I uploaded it manually. In the Application Settings I changed the value of the WEBSITES_LOAD_CERTIFICATES to * (it listed the thumbprint previously). I restarted the web app after that. However, the certificate doesn't get listed when performing the "Get-ChildItem -path cert:\LocalMachine\My". For some reason the certificate doesn't loaded/imported. – Richard Waal Oct 24 '18 at 19:34
  • That's because it'll not be stored in cert:\LocalMachine\My - that's my bad. It should be stored in cert:\CurrentUser\My - I'll update my answer – Trayek Oct 25 '18 at 8:09
  • So are you saying the self-signed client certificate should be listed when performing "Get-ChildItem -path cert:\LocalMachine\My" in Kudu? Because it's not in my case. The cert is listed in the portal under SSL Setings > Private Certificates and shows state healthy. And like I mentioned before, I configured the app setting WEBSITE_LOAD_CERTIFICATES=*. Any idea what I am missing here? Thanks again for the help. – Richard Waal Oct 25 '18 at 8:40
  • No, it's not in LocalMachine - it's in CurrentUser. So in Kudu, run this instead: Get-ChildItem -path cert:\CurrentUser\My Your SSL should show up in the list then (full disclosure I haven't tried this with self-signed certificate, but don't see why it'd be different). If that does not work, it's always possible to get a certificate using LetsEncrypt (letsencrypt.org) - which allows for free certificates, which have the bonus benefit of being trusted – Trayek Oct 25 '18 at 8:49
  • I just uploaded pfx that's used on the App Service Environment load balancer to the web app. The certificate error that was initially reported is now gone. However, now I get the following error: "The remote certificate is invalid according to the validation procedure". I suspect that the Sitecore web app is communicating to the xConnect Web App via the ASE load balancer. And because the cert that's configured on the load balancer is not trusted, the error is reported. The question now is how do I allow the connection of the self-signed certificate on the ASE? – Richard Waal Oct 25 '18 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.