5

I installed the vanilla Sitecore 9.0 version from Marketplace on Azure PaaS with XP and extra small configuration and select the option self signed certificate for xConnect client certificate, but when I browse my xConnect web apps, I am getting 403 error however my web apps is running in the backend.

Any suggestion?

enter image description here

Improve this question
1
  • I've found if I add that AllowInvalidClientCertificates=true on Single Web App installations in Azure that my site will go 500, and eventually 503. I haven't had this problem in multiple Web App installations.
    – crissb
    Oct 9, 2018 at 20:15

1 Answer 1

Reset to default
12

This issue happens because it is impossible to add self created certificate to the trusted list of Authorities in Azure as it is global thing.

But for developers environment, we should be able to use self signed certificates instead of purchasing real ones.

For certificates purchased from trusted vendors will not be an issue.

You just need to add a parameter AllowInvalidClientCertificates=true for every connection string which contains certificate

you will have something like: 

<add name="xconnect.collection.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=AAAAAA34364908AB8A72CBED502FEDC9DDB5A2;AllowInvalidClientCertificates=true" />

You need to have it in 4 places :

  1. xconnect.collection.certificate
  2. xdb.referencedata.client.certificate
  3. xdb.marketingautomation.reporting.client.certificate
  4. xdb.marketingautomation.operations.client.certificate

In the interest of saving people time, when deploying the xP1 topology in Azure PaaS, you will need to update the connection strings for the following 5 roles:

  1. Content Delivery (cd)
  2. Content Management (cm)
  3. Processing (prc)
  4. Marketing Automation - Operations (ma-ops)
  5. Dedicated Delivery Service (exm-dds)
Improve this answer
5
  • Its strange, my xConnect web apps still throwing 403 error, after changes suggested, however my data is capturing and I can see in the analytics reports.
    – Ashish Bansal
    Jan 12, 2018 at 13:02
  • Yep, this is normal behaviour, you need to have connection from CM to Xconnect not from local machine;
    – Vlad Iobagiu
    Jan 12, 2018 at 13:09
  • Yes, it should ask for client certificate, if any third party need to connect? I hope it will be fine, once I upload the valid authorized certificate.
    – Ashish Bansal
    Jan 12, 2018 at 13:14
  • 2
    I added information for which roles in a xP1 deployment need to be adjusted to prevent someone from spending time looking at all 9 server roles.
    – Pete Navarra ♦
    Jan 22, 2018 at 19:25
  • @SitecoreClimber I deployed my solution to Azure PaaS with self signed certificate but with XP0 topology. I did what is stated above, but throwing me an error that the certificate was not found. Do I also need to configure something?
    – ZQuiray
    Feb 12, 2018 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.