Connect Azure Website to Xero Partner Application

A 403 error means we are not seeing the Xero Entrust certificate in the connection.More details about it here - http://blog.xero.com/developer/api-overview/http-response-codes/#403

Basically , It runs on your local IIS instance because it is a "single tenant" machine where your application doesn't need to be isolated from others.

While you application is blocked by the security model used to isolate web sites.

In summary, you have to do the following to get your certificates working on Azure:

1) Export the certificate, private key, and all intermediary certificates into a PFX file.

2) Upload the certificate using the Azure portal to the cloud service that you're running (it should appear as multiple entries).

3) Access the certificate through the machine store in code.

Based on data taken from: https://community.xero.com/developer/discussion/626401

https://social.msdn.microsoft.com/Forums/azure/en-US/29b30f25-eea9-4e8e-8292-5ac8085fd42e/access-to-certificates-in-azure-web-sites

I hope it solved your issue.

Finally got this working and I will post my solution which will hopefully save developers a lot of time and frustration when connecting with Xero.

The Xero Partner Application will not work with Azure App Services (Web Sites). You have to upload two additional certificates along with your self-signed and the Xero partner certificate. These can be found on your local machine and can be exported in cer format (details of these certificates below). Not being able to upload these certificates for Azure app services is indeed the crutch. They also have to be uploaded to specific stores (Root/CA), which you cannot do with app services. These are the steps I took to connect with Xero.

1. Converted my web site to Azure Cloud Services: I was weary of changing our environment as we already have a live site. It turns out that cloud services is essentially the same as app services; you still are deploying to a VM somewhere. However, you have more control over the back end and you can remote desktop in. Read more here. Used links below to create and convert my website to cloud services:

   • Create a new cloud service project
   • Convert existing web site to cloud service

2. Uploaded 4 certificates to my cloud project using the azure portal. You will need to upload the following:

   • Your self-signed certificate (the one you created here)
   • The partner certificate issued by Xero (you probably got it here)
   • The Intermediate Entrust certificate (this one should be contained within the .p12 file you downloaded above)
   • The Entrust Root certificate (this should be in your Trusted Root Store**)

3. Added the certificates to my Web Role in the Cloud project. You have to right click on the properties of your web role and go to the certificates tab. Add all 4 certificates to your web role using the thumbprint which will be visible in the portal after you uploaded them. Take note of the Store Name for the two entrust certs:

You may have to adopt a lot of patience as I have to get through step one. You'll have to figure out the new deployment process, how to debug your project locally, and probably a lot of other frustrating tidbits!

**This is the correct Entrust Root certificate you can get by using certmgr.msc:

Make sure you added the application setting from step 2 of your referenced article.

Adding an app setting named WEBSITE_LOAD_CERTIFICATES with its value set to the thumbprint of the certificate will make it accessible to your web application. You can have multiple comma-separated thumbprint values or can set this value to “ * “ (without quotes) in which case all your certificates will be loaded to your web applications personal certificate store.

I'd also be more specific in specifying the certificate store, i.e. use:

var store = new X509Store(StoreName.My, StoreLocation.CurrentUser);

This is how we load certs in all of our Azure Web Apps.