You have a web app hosted on an on-premises server that is accessed by using a URL of https://www.contoso.com. You plan to migrate the web app to…

To secure a custom domain on an Azure App Service with an existing TLS/SSL certificate, you must import the certificate. Azure App Service requires the certificate to be uploaded as a password-protected Personal Information Exchange (PFX) file. This file format is a container that bundles the public certificate, any intermediate certificates, and the corresponding private key. The private key is essential for the server to decrypt incoming TLS traffic. Microsoft documentation explicitly states that the PFX file must be encrypted using the TripleDES algorithm for compatibility with the App Service platform.

A. A P7B file contains only public certificates and certificate chains; it lacks the mandatory private key needed for the server-side of the TLS handshake.

C. A CER file contains only the public key of a single certificate. It does not include the private key, which is required by the Azure App Service.

D. While PFX is the correct file format, the Azure App Service documentation specifically requires the PFX file to be encrypted using TripleDES, not AES256.

1. Microsoft Learn. (2023). Secure a custom domain with a TLS/SSL binding in Azure App Service. In the "Prerequisites" section

under the "Private certificate requirements" subsection

the documentation states: "To use a certificate in App Service

the certificate must meet all the following requirements: ... Exported as a password-protected PFX file

encrypted using triple DES." This directly supports the choice of a PFX file encrypted with TripleDES.

2. Microsoft Learn. (2023). Export an App Service certificate. In the "Export certificate to PFX" section

Step 5 notes: "The downloaded PFX file is a raw PKCS12 file that contains both the public and private certificates and has an import password that's an empty string. ... For use in App Service

you must re-encrypt the file with Triple DES." This reinforces the platform's specific encryption requirement.