CODEWITHSUNDEEP
azuresslazure-web-app-serviceazure-cli
Luuk
Luuk

Reputation: 1969

Bind SSL Certificate from KeyVault to webapp using Azure CLI

We are currently using the following ARM template to bind the an SSL certificate to a WebApp, but we want to migrate to Azure CLI, but cannot find a way to do this without downloading the certificate.

{
  "type": "Microsoft.Web/certificates",
  "name": "[variables('certificateName')]",
  "apiVersion": "2016-03-01",
  "location": "[resourceGroup().location]",
  "properties": {
    "keyVaultId": "[resourceId(parameters('existingKeyVaultResourceGroup'), 'Microsoft.KeyVault/vaults',parameters('existingKeyVaultId'))]",
    "keyVaultSecretName": "[parameters('existingKeyVaultSecretName')]",
    "serverFarmId": "[resourceId('Microsoft.Web/serverFarms',variables('hostingPlanName'))]"
  }
},
{
  "type": "Microsoft.Web/sites/hostnameBindings",
  "name": "[concat(variables('webAppName'), '/', variables('hostname'))]",
  "apiVersion": "2016-03-01",
  "location": "[resourceGroup().location]",
  "properties": {
    "sslState": "SniEnabled",
    "thumbprint": "[reference(resourceId('Microsoft.Web/certificates', variables('certificateName'))).Thumbprint]"
  },
  "dependsOn": [
    "[concat('Microsoft.Web/certificates/',variables('certificateName'))]"
  ]
}

Upvotes: 0

Views: 1849

Answers (2)

Pankaj
Pankaj

Reputation: 9

TLS/SSL --> Private key certificate --> import key vault certificate

can any one please share arm/script to configure.

Manaully we are apply to do and we need script to perform

image here

Upvotes: 0

George Chen
George Chen

Reputation: 14334

This is sample script on the official site, if you don't want to download it, you should have it on your local.

#!/bin/bash

fqdn=<replace-with-www.{yourdomain}>
pfxPath=<replace-with-path-to-your-.PFX-file>
pfxPassword=<replace-with-your=.PFX-password>
resourceGroup=myResourceGroup
webappname=mywebapp$RANDOM

# Create a resource group.
az group create --location westeurope --name $resourceGroup

# Create an App Service plan in Basic tier (minimum required by custom domains).
az appservice plan create --name $webappname --resource-group $resourceGroup --sku B1

# Create a web app.
az webapp create --name $webappname --resource-group $resourceGroup \
--plan $webappname

echo "Configure a CNAME record that maps $fqdn to $webappname.azurewebsites.net"
read -p "Press [Enter] key when ready ..."

# Before continuing, go to your DNS configuration UI for your custom domain and 
follow the 
# instructions at https://aka.ms/appservicecustomdns to configure a CNAME record for 
the 
# hostname "www" and point it your web app's default domain name.

# Map your prepared custom domain name to the web app.
az webapp config hostname add --webapp-name $webappname --resource-group 
$resourceGroup \
--hostname $fqdn

# Upload the SSL certificate and get the thumbprint.
thumbprint=$(az webapp config ssl upload --certificate-file $pfxPath \
--certificate-password $pfxPassword --name $webappname --resource-group 
$resourceGroup \
--query thumbprint --output tsv)

# Binds the uploaded SSL certificate to the web app.
az webapp config ssl bind --certificate-thumbprint $thumbprint --ssl-type SNI \
--name $webappname --resource-group $resourceGroup

echo "You can now browse to https://$fqdn"

Hope this could help you, if you still have other questions, please let me know.

Upvotes: 1

Related Questions