I installed the vanilla Sitecore 9.0 version from Marketplace on Azure PaaS with XP and extra small configuration and select the option self signed certificate for xConnect client certificate, but when I browse my xConnect web apps, I am getting 403 error however my web apps is running in the backend.

Any suggestion?

enter image description here

  • I've found if I add that AllowInvalidClientCertificates=true on Single Web App installations in Azure that my site will go 500, and eventually 503. I haven't had this problem in multiple Web App installations.
    – crissb
    Oct 9 '18 at 20:15

This issue happens because it is impossible to add self created certificate to the trusted list of Authorities in Azure as it is global thing.

But for developers environment, we should be able to use self signed certificates instead of purchasing real ones.

For certificates purchased from trusted vendors will not be an issue.

You just need to add a parameter AllowInvalidClientCertificates=true for every connection string which contains certificate

you will have something like:

<add name="xconnect.collection.certificate" connectionString="StoreName=My;StoreLocation=CurrentUser;FindType=FindByThumbprint;FindValue=AAAAAA34364908AB8A72CBED502FEDC9DDB5A2;AllowInvalidClientCertificates=true" />

You need to have it in 4 places :

  1. xconnect.collection.certificate
  2. xdb.referencedata.client.certificate
  3. xdb.marketingautomation.reporting.client.certificate
  4. xdb.marketingautomation.operations.client.certificate

In the interest of saving people time, when deploying the xP1 topology in Azure PaaS, you will need to update the connection strings for the following 5 roles:

  1. Content Delivery (cd)
  2. Content Management (cm)
  3. Processing (prc)
  4. Marketing Automation - Operations (ma-ops)
  5. Dedicated Delivery Service (exm-dds)
  • Its strange, my xConnect web apps still throwing 403 error, after changes suggested, however my data is capturing and I can see in the analytics reports. Jan 12 '18 at 13:02
  • Yep, this is normal behaviour, you need to have connection from CM to Xconnect not from local machine; Jan 12 '18 at 13:09
  • Yes, it should ask for client certificate, if any third party need to connect? I hope it will be fine, once I upload the valid authorized certificate. Jan 12 '18 at 13:14
  • 2
    I added information for which roles in a xP1 deployment need to be adjusted to prevent someone from spending time looking at all 9 server roles. Jan 22 '18 at 19:25
  • @SitecoreClimber I deployed my solution to Azure PaaS with self signed certificate but with XP0 topology. I did what is stated above, but throwing me an error that the certificate was not found. Do I also need to configure something?
    – ZQuiray
    Feb 12 '18 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.