Azure App Service上Sitecore 9 PAAS环境随机出现SSL连接错误求助

Let's break down the random SSL errors and redirect failures you're seeing with your multi-site Sitecore 9 deployment on Azure PaaS. This kind of intermittent issue usually ties to configuration inconsistencies across Azure App Service instances, certificate binding gaps, or conflicting rules between IIS and Sitecore. Here's a structured approach to diagnose and fix the problem:

1. Validate Azure App Service Certificate Bindings #

First, rule out the most common culprit: misconfigured or unsynchronized SSL certificate bindings across your App Service instances.

• Head to the Azure Portal, navigate to your App Service, and go to TLS/SSL settings > Private Key Certificates (.pfx). Confirm all 3 wildcard certificates are active, unexpired, and show no validation errors.
• Check Hostname Bindings next:
  • Ensure each root domain (example.com, 123.com, xyz.com) and its www subdomain are bound to the corresponding wildcard certificate (e.g., *.example.com for both example.com and www.example.com).
  • Verify the binding type is set to SNI SSL (this is standard for multi-site PaaS deployments; IP SSL is rarely needed here).
• Intermittent errors often happen when some App Service instances don't have the certificate properly applied—restarting the App Service can force sync across all instances. Use the Azure CLI command if you prefer:

  az webapp restart --name <your-app-name> --resource-group <your-rg-name>
  

2. Audit IIS Redirect Rule Configuration #

Remember: SSL handshake happens before any IIS redirect logic runs. If you're seeing SSL errors on root domains, the redirect won't even trigger until the certificate issue is fixed. But if certificates check out, verify your redirect rules:

• Open IIS Manager for your Sitecore instance, go to URL Rewrite and inspect your root-to-www rules. A solid rule should cover both HTTP and HTTPS, like this example for example.com:

  <rule name="Redirect example.com to www (HTTPS)" stopProcessing="true">
    <match url="(.*)" />
    <conditions>
      <add input="{HTTP_HOST}" pattern="^example.com$" />
    </conditions>
    <action type="Redirect" url="https://www.example.com/{R:1}" redirectType="Permanent" />
  </rule>
  

• Avoid overlapping rules (e.g., separate HTTP-to-HTTPS and root-to-www rules can conflict). Combine them into a single rule to simplify and reduce edge cases:

  <rule name="Force HTTPS + Root to www" stopProcessing="true">
    <match url="(.*)" />
    <conditions logicalGrouping="MatchAny">
      <add input="{HTTPS}" pattern="off" />
      <add input="{HTTP_HOST}" pattern="^example.com$|^123.com$|^xyz.com$" />
    </conditions>
    <action type="Redirect" url="https://www.{C:1}.com/{R:1}" redirectType="Permanent" />
  </rule>
  

3. Check Sitecore Multi-Site Configuration #

Sitecore's own site definitions can interfere with IIS redirects if misconfigured:

• Open your site-specific config file (usually in App_Config/Include/YourSite/) and verify the hostName attribute for each site includes both the root and www domains:

  <site name="example" hostName="example.com|www.example.com" targetHostName="www.example.com" ... />
  

• Setting targetHostName to the www variant ensures Sitecore generates links pointing directly to the www domain, reducing unnecessary root domain requests in the first place.
• Also, check if any custom pipeline processors (like in RequestBegin) are overriding or intercepting redirect logic—these can sometimes block IIS rules from firing.

4. Run Detailed SSL Diagnostics #

To confirm intermittent certificate issues, run repeated SSL tests:

• Use the openssl command-line tool to check the certificate returned on multiple requests:

  openssl s_client -connect example.com:443
  

  Run this 5-10 times and compare the certificate output. If you see different certificates or invalid chains, that's a sign of inconsistent certificate deployment across App Service instances.
• Use SSL Labs' Server Test to check for certificate chain issues, SNI support gaps, or other configuration flaws that might cause intermittent failures.

5. Verify Certificate Chain Completeness #

Azure App Service sometimes requires full certificate chains (root + intermediate) to work reliably. If your wildcard certificates only include the leaf certificate, intermediate certificates might be missing on some instances, causing random SSL errors.

• Re-upload your certificates to Azure, ensuring you include the full chain (most certificate authorities provide a "bundle" file with all necessary certificates).

内容的提问来源于stack exchange，提问作者Saad Ahmed Khan