{"id":15430555,"url":"https://github.com/lenisha/appsrvc-tls","last_synced_at":"2026-05-09T19:31:47.364Z","repository":{"id":116069335,"uuid":"162212933","full_name":"lenisha/appsrvc-tls","owner":"lenisha","description":"Windows truststore with AppService Java and Node applications","archived":false,"fork":false,"pushed_at":"2018-12-20T22:06:44.000Z","size":2661,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-06-24T06:07:58.976Z","etag":null,"topics":["appservice","azure-app-service","certificate","java","nodejs","truststore","win-ca","windows"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lenisha.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-12-18T01:33:40.000Z","updated_at":"2018-12-20T22:07:22.000Z","dependencies_parsed_at":"2024-07-10T00:00:18.146Z","dependency_job_id":null,"html_url":"https://github.com/lenisha/appsrvc-tls","commit_stats":{"total_commits":11,"total_committers":1,"mean_commits":11.0,"dds":0.0,"last_synced_commit":"66be519ceba6aafc37d9bfe6f79ae9b102de4140"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/lenisha/appsrvc-tls","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fappsrvc-tls","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fappsrvc-tls/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fappsrvc-tls/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fappsrvc-tls/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lenisha","download_url":"https://codeload.github.com/lenisha/appsrvc-tls/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fappsrvc-tls/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32832874,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-08T08:22:46.396Z","status":"online","status_checked_at":"2026-05-09T02:00:06.633Z","response_time":123,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appservice","azure-app-service","certificate","java","nodejs","truststore","win-ca","windows"],"created_at":"2024-10-01T18:16:56.394Z","updated_at":"2026-05-09T19:31:47.344Z","avatar_url":"https://github.com/lenisha.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Sample Azure App Service Applications using custom truststore\n\n## Java application\n`demo-java` - this is sample SpringBoot application (war packaged) that runs in App Service and invokes HTTPS api \nwith self signed server certificate. Certificate trust stores are set Java applications using settings such as\n\n```java\n-Djavax.net.ssl.trustStore=/path/to/store\n-Djavax.net.ssl.trustStoreType=JKS|PKCS12|Windows-MY|Windows-ROOT\n``` \n\n### TLS connection with Trusted certificates from Windows Store:\n\n- In App Service Environment (Windows) upload certificate in the `WebApp \u003e SSL Settings \u003e Public certificate`\n- Set Java application to use `Windows-ROOT` windows certificate store. Add `JAVA_OPS` environment variable to set this setting for Java process\n```java\nJAVA_OPTS=-Djavax.net.ssl.trustStoreType=Windows-ROOT\n```\nFor details on deployment see example in `pom.xml`\n\n- As per [ASE docs](https://docs.microsoft.com/en-us/azure/app-service/environment/certificates#private-client-certificate) \nset `WEBSITE_LOAD_ROOT_CERTIFICATES` Application Setting variable to comma delimited list of certificate thumbprints\nFor details see example in `pom.xml`\nAll applications sharing same AppService Plan will have certificate available in LocalMachine root truststore\n\n- Build and deploy \n```shell \nmvn clean package azure-webapp:deploy\n```\n\n- Resulting deployment should be able to establish communication\n![app settings](https://github.com/lenisha/appsrvc-tls/raw/master/demo-java/java-settings.png \"App Settings\")\n\n## Node Application\n`demo-node` - sample express NodeJS application communicating to HTTPS api with self signed server certificate\n\n### TLS connection with Trusted certificates from Windows Store:\n\nTo enable node reading Windows cert store instead of environment variable, use `win-ca` module https://github.com/ukoloff/win-ca, it relies internally on native `crypto32.dll` api to fetch Root CAs from Windows' store (Trusted Root Certification Authorities) and make them available to Node.js application with minimal efforts.\n\ninclude in application code\n\n```\nlet ca = require('win-ca')\n```\n\nCertificates will be deduplicated and installed to https.globalAgent.options.ca so they are automatically used for all requests with Node.js' https module. (you could see them as well in node-modules\\win-ca\\pem)\n\n\nTo run Node.JS on Azure AppService:\n\n- As per [ASE docs](https://docs.microsoft.com/en-us/azure/app-service/environment/certificates#private-client-certificate) \nset `WEBSITE_LOAD_ROOT_CERTIFICATES` Application Setting variable to comma delimited list of certificate thumbprints\n\n- Set Application Settings variable `WEBSITE_NODE_DEFAULT_VERSION` to required NodeJs version (run `az webapp list runtimes` to see supported versions)\n\n- Important! Set Platform to ***`64bit`***\n\n- Upload application zip along (not including `node_modules`) via Kudu https://scm.site/ZipDeployUI  or connecting to git\n- Start the app\n\n- Resulting deployment should be able to establish communication\n![app settings](https://github.com/lenisha/appsrvc-tls/raw/master/demo-node/node-settings-64.png \"App Settings\")\n\n\n## TLS connection using path to certificate file\nNode also allows application to extend it's default certificate store by providing `NODE_EXTRA_CA_CERTS` env variable\n\n\n```sh\nNODE_EXTRA_CA_CERTS=/path/to/pem\n```\nor in `package.json`\n\n```dtd\n   \"start\": \"ENV NODE_EXTRA_CA_CERTS=/path/to/pem node app.js\"\n```\n\nTo run Node.JS on Azure AppService with tls setting:\n\n- Set Application Settings variable `NODE_EXTRA_CA_CERTS` with absolute path to certificate (e.g D:\\home\\site\\wwwroot\\server-ca.cer)\n\n- Resulting deployment should be able to establish communication\n![app settings](https://github.com/lenisha/appsrvc-tls/raw/master/demo-node/node-settings.png \"App Settings\")\n\nNotes:\nNode application on Azure App Service is hosted using `iisnode` httpModule, with most of configuration setup in `web.config`\n[Kudu magic for iisnode](https://blog.lifeishao.com/2017/03/24/custom-nodejs-deployment-on-azure-web-app/)\n\n\n### List certificates in App Service\nOpen Powershell in Kudu\n\n```powershell\nset-location cert:\\LocalMachine\\My\nget-childitem\n```\n\n### Create Sel-Signed certificate for tests\n\nAzure App Service requires certificate with extension `Server Authentication`\nTo create such certificate sample config file `certs\\cert_config`\n\n```sh\nopenssl req -x509 -config cert_config -extensions 'my server exts' -nodes \\\n             -days 365 -newkey rsa:2048 -keyout myserver.key -out myserver.pem\nopenssl pkcs12 -export -in myserver.pem -inkey myserver.key -out myserver.pfx\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flenisha%2Fappsrvc-tls","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flenisha%2Fappsrvc-tls","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flenisha%2Fappsrvc-tls/lists"}