Search code examples
azureopensslazure-webappsazure-linux

Azure Linux web app: change OpenSSL default security level?

In my Azure Linux web app, I'm trying to perform an API call to an external provider, with a certificate. That call fails, while it's working fine when deploying the same code on a Windows app service plan. The equivalent cURL command line is:

curl --cert-type p12 --cert /var/ssl/private/THUMBPRINT.p12 -X POST https://www.example.com

The call fails with the following error:

curl: (58) could not load PKCS12 client certificate, OpenSSL error error:140AB18E:SSL routines:SSL_CTX_use_certificate:ca md too weak

The issue is caused by OpenSSL 1.1.1d, which by defaults requires a security level of 2, and my certificate is signed with SHA1 with RSA encryption:

openssl pkcs12 -in THUMBPRINT.p12 -nodes  | openssl x509 -noout -text | grep 'Signature Algorithm'

    Signature Algorithm: sha1WithRSAEncryption
    Signature Algorithm: sha1WithRSAEncryption

On a normal Linux VM, I could edit /etc/ssl/openssl/cnf to change 

CipherString = DEFAULT@SECLEVEL=2

to security level 1, but on an Azure Linux web app, the changes I make to that file are not persisted..

So my question is: how do I change the OpenSSL security level on an Azure web app? Or is there a better way to allow the use of my weak certificate?

Note: I'm not the issuer of the certificate, so I can't regenerate it myself. I'll check with the issuer if they can regenerate it, but in the meantime I'd like to proceed if possible :)

Solution

  • A call with Microsoft support led me to a solution. It's possible to run a script whenever the web app container starts, which means it's possible to edit the openssl.cnf file before the dotnet app in launched.

    To do this, navigate to the Configuration blade of your Linux web app, then General settings, then Startup command:

    Azure configuration blade

    The Startup command is a command that's ran when the container starts. You can do what you want, but it HAS to launch your app, because it's no longer done automatically.

    You can SSH to your Linux web app, and edit that custom_startup.sh file:

    #!/usr/sh

# allow weak certificates (certificate signed with SHA1)
# by downgrading OpenSSL security level from 2 to 1
sed -i 's/SECLEVEL=2/SECLEVEL=1/g' /etc/ssl/openssl.cnf

# run the dotnet website
cd /home/site/wwwroot
dotnet APPLICATION_DLL_NAME.dll

    The relevant doc can be found here: https://learn.microsoft.com/en-us/azure/app-service/containers/app-service-linux-faq#built-in-images

    Note however that the Startup command is not working for Azure Functions (at the time of writing May 19th, 2020). I've opened an issue on Github.

    To work around this, I ended up creating custom Docker images:

    Dockerfile for a webapp:

    FROM mcr.microsoft.com/appsvc/dotnetcore:3.1-latest_20200502.1

# allow weak certificates (certificate signed with SHA1)
# by downgrading OpenSSL security level from 2 to 1
RUN sed -i 's/SECLEVEL=2/SECLEVEL=1/g' /etc/ssl/openssl.cnf

    Dockerfile for an Azure function:

    FROM mcr.microsoft.com/azure-functions/dotnet:3.0.13614-appservice

# allow weak certificates (certificate signed with SHA1)
# by downgrading OpenSSL security level from 2 to 1
RUN sed -i 's/SECLEVEL=2/SECLEVEL=1/g' /etc/ssl/openssl.cnf