Securing Sitecore 9.0.2 PAAS xDB & xConnect Server Role Services

Question

We are using Sitecore 9.0.2 PAAS on Azure and we found that below server roles are not on https instead they are on http

xDB Role Services

Processing (prc)

Reporting (rep)

xConnect Server Role Services

Marketing Automation Operations (ma-ops)

Marketing Automation Reporting (ma-rep)

xConnect Collection (xc-collect)

exm dds webapp

question and how is this possible to run this webapps on https and why Sitecore is not forcing these webapps to be on https

Answer 1

If you installed via the out-of-the box ARM templates, all roles should already be running on https provided by Azure (*.azurewebsites.net). For instance, check the xconnect.collection connectionstring on your cd server, it should point to an https url.

If you want to use custom domain names, you need to purchase an ssl certificate and upload it into azure. You should also create custom domains. To conclude, you must bind the custom domain with the uploaded certificate.

If you want to force https usage you can add this in your web.config

<system.web>
  <httpCookies httpOnlyCookies="true" requireSSL="true" lockItem="true" />
</system.web>

You can also put https-only on the ssl settings in azure.

Another method is to add an https redirect rule in your web.config

  <rule name="Force HTTPS Redirection" enabled="true" stopProcessing="true">
      <match url="(.*)" />
      <conditions>
        <add input="{HTTPS}" pattern="^OFF$" />
        <add input="{HTTP_METHOD}" pattern="GET" />
      </conditions>
      <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" appendQueryString="true" redirectType="Permanent" />
    </rule>

You can also ip-restrict these roles to keep it more secure.

Note that the xConnect services are secured by using client certificates. So the CD should have the same certificate loaded to be able to communicate with the xConnect services. These certificates should have clientauthentication enabled.

More info can be found in the sitecore documentation. https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/enable-https-for-core-roles.html