Examkin

Question

Difficulty: MediumProvision and Configure Azure API Management

You have a Standard tier Azure API Management (APIM) instance named apim-service with the default gateway URL apim-service.azure-api.net. You need to configure a custom domain api.contoso.com for the gateway endpoint. The TLS certificate must be managed and automatically renewed by Azure. Which sequence of steps should you perform to configure the custom domain?

  1. 1Create a DNS CNAME record that points the custom domain to the default API Management gateway hostname.
  2. 2In the Azure portal, add a custom domain to the API Management Gateway endpoint.
  3. 3Select Managed as the certificate option for the custom domain.
  4. 4Save the custom domain configuration to initiate ownership verification and certificate provisioning.

Answer

To configure a custom domain with an Azure-managed certificate, you must first create a DNS CNAME record pointing the custom domain to the default gateway hostname, add the custom domain for the Gateway endpoint in the Azure portal, choose the Managed certificate option, and then save the configuration to trigger verification and provisioning.
The correct order ensures that domain ownership can be verified dynamically by API Management. The CNAME record must exist in DNS before saving the custom domain configuration in Azure. Once the configuration is saved with the Managed certificate option selected, Azure verifies the CNAME record and requests the certificate from the Certificate Authority.

Step-by-Step Solution

1
Create a CNAME record in your DNS provider pointing the custom domain to the default API Management gateway hostname.
The DNS system starts propagating the CNAME record.
Azure API Management requires the CNAME record to be in place before configuring the custom domain with a managed certificate, as it queries the DNS to verify domain ownership.
2
In the Azure portal, navigate to the API Management Custom domains settings and add a custom domain for the Gateway endpoint.
The custom domain configuration form is opened and populated with the custom hostname.
This associates the custom domain with the Gateway service endpoint of your API Management instance.
3
Set the Certificate type to Managed.
API Management is configured to request a free, managed TLS certificate instead of requiring an uploaded custom certificate or Azure Key Vault integration.
Choosing the Managed option tells Azure to handle both the creation and automatic renewal of the TLS certificate.
4
Save the custom domain configuration.
The API Management service validates the CNAME record and begins provisioning the TLS certificate.
Saving the configuration triggers the asynchronous ownership verification and certificate binding process.

Key Concept

Configuring custom domains with Azure Managed Certificates in API Management
Rate this question

Topics

Provision and Configure Azure API Management