title: Adding self-signed root certificate to Azure App Service
body: <p>I have an Azure based .NET web app that we are trying to connect to a client's local ADFS environment. We are able to get access to the resource via the Azure Hybrid Connection, but when we try to get an authentication header from ADFS we get a certificate error.</p>
  
  <p>After doing some digging, we found they are not using a certificate from a trusted root CA and instead are using a self-signed certificate. The client has sent us their root CA (along with intermediates) certificate and is asking us to have our Azure application trust these.</p>
  
  <p>1) Is this possible?</p>
  
  <p>2) Are there any security risks from doing so?</p>
  
  <p>I found this document about adding certificates to your app service but I don't think this will 'trust' any certificates signed by their root CA certificate and instead is trusting just that certificate by itself.
  <a href="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-ssl-cert-load" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/app-service/app-service-web-ssl-cert-load</a></p>
  
  <p>I also found this question, which is from 2015 and was curious if this answer had changed since then.
  <a href="https://stackoverflow.com/questions/33884634/how-can-i-trust-an-active-directory-root-ca-certificate-in-an-azure-web-applicat">How can I trust an Active Directory Root CA Certificate in an Azure Web Application?</a></p>
  
  <p>And the actual error we get when try to connect to their ADFS currently:</p>
  
  <blockquote>
    <p>System.Net Information: 0 : [13800] SecureChannel#55196503 - Remote
    certificate has errors: </p>
    
    <p>System.Net Information: 0 : [13800] SecureChannel#55196503 -     A
    certificate chain could not be built to a trusted root authority. </p>
    
    <p>System.Net Information: 0 : [13800] SecureChannel#55196503 - Remote
    certificate was verified as invalid by the user. </p>
    
    <p>System.Net Error: 0 : [13800] Exception in HttpWebRequest#44115416:: -
    The underlying connection was closed: Could not establish trust
    relationship for the SSL/TLS secure channel..</p>
  </blockquote>