Using Your Own SSL Certificate on Azure and Google Cloud

To use your own Azure SSL certificate, you upload it as a password-protected PFX file (a single file that bundles certificate, chain and private key) to App Service, Application Gateway or Azure Key Vault. On Google Cloud, you upload the certificate and an unencrypted private key as PEM files (Base64 text files) to a load balancer or Certificate Manager.

Both clouds also issue free managed DV certificates for some services. You buy your own when you need OV or EV validation, wildcards where managed certificates don’t offer them, or one certificate you can move between providers.

Service	Your own certificate	Format
Azure App Service	Upload or import from Key Vault	Password-protected PFX with full chain
Azure Application Gateway	Upload to listener or reference Key Vault	PFX with password
Azure virtual machine	Install in the web server like any server	Depends on the server software
Google Cloud load balancer	Compute SSL certificate or Certificate Manager	PEM certificate (with chain) + PEM key without passphrase

Azure SSL certificate options: managed or your own?

Azure App Service offers a free managed certificate for custom domains, and you can also upload or import your own. As of October 2026, Microsoft documents that the free App Service managed certificate is issued by DigiCert, does not support wildcards, cannot be exported and is not available in App Service Environment.

Your own certificate removes those limits. It also lets you use the same certificate on Application Gateway, a virtual machine or another cloud. Azure DNS only hosts your DNS zone; it does not issue certificates, but you can add your CA’s DNS validation record there.

Azure SSL certificate need	Managed App Service certificate	Your own certificate
Simple custom domain on App Service	Yes	Yes
Wildcard	No	Yes
OV or EV validation	No (DV only)	Yes
Export and reuse elsewhere	No	Yes
App Service Environment	No	Yes

How to upload your own certificate to Azure App Service

You upload your own certificate to Azure App Service as a password-protected PFX file that contains the server certificate, all intermediate certificates and the private key. Then you bind it to your custom domain.

Microsoft lists these requirements for a private certificate used to secure a custom domain: password-protected PFX, full chain included, an extended key usage for server authentication, and a trusted CA signature. Every SSL/TLS certificate sold on BUY-SSL.com is issued by a publicly trusted CA for server authentication. Your App Service plan must be on the Basic tier or higher.

Our CSR generator creates the key pair and signing request in the browser. If you prefer the command line, OpenSSL builds the PFX in one step:

openssl pkcs12 -export -out example.pfx -inkey example.key -in example.crt -certfile intermediate.crt

OpenSSL asks for an export password; App Service needs it during upload. For more format conversions, see our SSL decoder.

Tip: Store the PFX in Azure Key Vault instead of uploading it to each app. App Service can import a PKCS12 certificate from Key Vault and, per Microsoft, syncs a renewed certificate version within 24 hours. That also keeps the file out of Azure DevOps repositories and pipeline variables.

Azure Application Gateway and virtual machines

Application Gateway accepts your certificate in two ways: a PFX file uploaded directly to the listener with its password, or a reference to a PFX stored in Key Vault. Key Vault is the better long-term choice, because renewing means updating one secret instead of every gateway.

On an Azure virtual machine, nothing is Azure-specific. You install the certificate in IIS, Apache or Nginx exactly as on any server; our guide on how to install an SSL certificate covers each one.

Google Cloud SSL certificates for load balancers

Google Cloud load balancers accept two kinds of certificates: Google-managed DV certificates that Google requests and renews for you, and self-managed certificates that you upload. Certificate Manager supports both for most load balancer types.

To create a Google-managed certificate on a global external Application Load Balancer, you list the domains:

gcloud compute ssl-certificates create www-cert --domains=www.example.com,example.com --global

To upload your own certificate, point to the PEM files instead:

gcloud compute ssl-certificates create own-cert --certificate=fullchain.pem --private-key=example.key --global

Google’s documentation sets three conditions for self-managed certificates: PEM format, a private key without passphrase, and an RSA or ECDSA key. Google does not validate the chain for you, so put your server certificate first and the intermediates after it in the certificate file. Google-managed Compute Engine certificates are not supported on regional and cross-region internal load balancers; use self-managed certificates or Certificate Manager there.

Are Google-managed certificates free?

Yes, for the certificate itself within Google Cloud load balancers, as of October 2026. Through Certificate Manager, Google lists the first 100 certificates per project as free; larger volumes and some key types and mTLS traffic are billed. Check Google’s Certificate Manager pricing page for current terms.

The free part covers DV only. A Google-managed certificate never names your organization, and Google requests and serves it only on Google Cloud services.

Which format do Azure and Google Cloud need: PFX or PEM?

Azure needs PFX, and Google Cloud needs PEM. CAs usually deliver PEM files (.crt or .pem), so for Azure you convert them to PFX; for Google Cloud you upload them as they are.

Platform	Format	Private key	Chain
Azure App Service	PFX (PKCS#12)	Inside the PFX, password-protected	Full chain inside the PFX
Azure Application Gateway	PFX	Inside the PFX, password required	Include intermediates
Google Cloud load balancer	PEM	Separate PEM file, no passphrase	Append intermediates to the certificate file

When should you buy instead of using managed certificates?

Buy your own certificate when you need OV or EV validation, a wildcard on App Service, or one certificate you can carry between Azure, Google Cloud, AWS and on-premises servers. Managed certificates are DV-only and tied to one platform.

Good fit for a purchased certificate	Pick a managed certificate if
Customers or auditors expect your verified company name	A DV certificate meets every requirement you have
You need a wildcard on Azure App Service	All traffic ends on one Google or Azure service
The same hostnames run on several clouds or servers	You never need to export the key
You want one CA, one renewal and one support contact	Automatic renewal by the platform is your top priority

For the general trade-offs, see free vs paid SSL. If part of your stack runs on Amazon, our guide to paid SSL on AWS covers ACM import, load balancers and CloudFront.

Renewing your own certificate in the cloud

As of October 2026, publicly trusted TLS certificates last at most 200 days. That drops to 100 days on 15 Mar 2027 and to 47 days on 15 Mar 2029, so uploaded certificates must be replaced several times a year.

Keep each certificate in one place, such as Azure Key Vault or Google Certificate Manager, and point services at it. A 1-, 2- or 3-year plan at BUY-SSL is a subscription term with free reissues; each certificate issued under it follows the maximum lifetime, so plan for regular reissue and upload.