How to make app service plan managed certificated for subject alternative names in azure?

Question

How to make app service plan managed certificated for subject alternative names in azure?

Heeyoung Eom (엄희영) 146

If you don't support the subject alternative names yet, How can I grant certificates to each of the domains?

Can you tell me an example that reflects multiple certificates? Below is my example code.

resource "azurerm_app_service_custom_hostname_binding" "service_host_bind" {      
     for_each                     =  azurerm_dns_cname_record.cname_target       
     hostname                  = trim(each.value.fqdn, ".")       
     app_service_name     = azurerm_app_service._service.name       
     resource_group_name = azurerm_resource_group._rg.name       
     depends_on          = [azurerm_dns_txt_record._txt_target] 
     lifecycle {         ignore_changes = [ssl_state, thumbprint]       }    }

resource "azurerm_app_service_managed_certificate" "_service_manage_cert" {   
     for_each                    = azurerm_app_service_custom_hostname_binding._service_host_bind   
     custom_hostname_binding_id  = each.value.id      }

resource "azurerm_app_service_certificate_binding" "xtrm_service_certi_bind" {   
     hostname_binding_id = azurerm_app_service_custom_hostname_binding._service_host_bind.id   // ## how to for_each??
     certificate_id               = azurerm_app_service_managed_certificate._service_manage_cert.id         // ## how to for_each??
     ssl_state           = "SniEnabled"        }

What should I do?
Hostname_binding_id and can we satisfy two certificate_ids?

Is it the right direction to issue each certificate?

I checked the document below and I know that not support yet.

https://stackoverflow.com/questions/64865555/manage-subject-alternative-name-for-app-service-certificate

Currently, we have prepared several domains for redirect, and we tried to grant certificates for each.
For example, when there is an endpoint domain (www.azure.com), domains for redirect: auz-ure.com, auz-ure.com, az-ops.shop, etc.
(azure-redirect.net -> www.azure.com
auz-ure.com -> www.azure.com
az-ops.shop -> www.azure.com)

For the terraform code, I referred to the document.

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service_managed_certificate

ajkuma 28,036 Reputation points Microsoft Employee Moderator

2021-11-26T20:08:16.983+00:00

HeeyoungEom-0524, Apologies for the delay in responding here. Thanks for posting a great question and sharing your valuable feedback. I'm checking on this internally and will get back to you soon.
Heeyoung Eom (엄희영) 146 Reputation points

2021-11-27T07:39:17.86+00:00

Hello
The above problem has been solved to some extent.

The current problem seems that multiple free certificates do not work as terraform.

Can you check about the problem?
Heeyoung Eom (엄희영) 146 Reputation points

2021-11-27T07:42:37.887+00:00

Hello, I have an additional question.

We are working on redirect configuration for http to https in the azure application gateway.
However, https requires "Ssl Certificate must be specialized".

How do you create a service plan free certified and use it in the application gateway?
ajkuma 28,036 Reputation points Microsoft Employee Moderator

2021-11-29T10:46:04.127+00:00
HeeyoungEom-0524 , Thanks for the follow-up and additional details.

When you say, "The current problem seems that multiple free certificates do not work as terraform." what specific issue you had encountered?
and "How do you create a service plan free certified", just to clarify, are you asking if App Service Managed Certificate can be leveraged for Application Gateway (TLS termination and end to end TLS with multi-tenant services)? -while I dig into this further and follow-up.

The free certificate comes with the following limitations:

Does not support wildcard certificates.

Does not support usage as a client certificate by certificate thumbprint (removal of certificate thumbprint is planned).

Is not exportable.

Is not supported on App Service not publicly accessible.

Is not supported on App Service Environment (ASE).

Is not supported with root domains that are integrated with Traffic Manager.

If a certificate is for a CNAME-mapped domain, the CNAME must be mapped directly to <app-name>.azurewebsites.net.

Thanks for your patience and co-operation!

1 answer

Your answer

ajkuma 28,036 Reputation points Microsoft Employee Moderator

2021-11-26T20:08:16.983+00:00

HeeyoungEom-0524, Apologies for the delay in responding here. Thanks for posting a great question and sharing your valuable feedback. I'm checking on this internally and will get back to you soon.
Heeyoung Eom (엄희영) 146 Reputation points

2021-11-27T07:39:17.86+00:00

Hello
The above problem has been solved to some extent.

The current problem seems that multiple free certificates do not work as terraform.

Can you check about the problem?
Heeyoung Eom (엄희영) 146 Reputation points

2021-11-27T07:42:37.887+00:00

Hello, I have an additional question.

We are working on redirect configuration for http to https in the azure application gateway.
However, https requires "Ssl Certificate must be specialized".

How do you create a service plan free certified and use it in the application gateway?
ajkuma 28,036 Reputation points Microsoft Employee Moderator

2021-11-29T10:46:04.127+00:00

HeeyoungEom-0524 , Thanks for the follow-up and additional details.

When you say, "The current problem seems that multiple free certificates do not work as terraform." what specific issue you had encountered?
and "How do you create a service plan free certified", just to clarify, are you asking if App Service Managed Certificate can be leveraged for Application Gateway (TLS termination and end to end TLS with multi-tenant services)? -while I dig into this further and follow-up.

The free certificate comes with the following limitations:

Does not support wildcard certificates.

Does not support usage as a client certificate by certificate thumbprint (removal of certificate thumbprint is planned).

Is not exportable.

Is not supported on App Service not publicly accessible.

Is not supported on App Service Environment (ASE).

Is not supported with root domains that are integrated with Traffic Manager.

If a certificate is for a CNAME-mapped domain, the CNAME must be mapped directly to <app-name>.azurewebsites.net.

Thanks for your patience and co-operation!

Answer 1

How do you create a service plan free certified and use it in the application gateway?

Apologies for the delay! Following-up to confirm on this-

HeeyoungEom-0524, App Service Managed Certificate (ASMC) only lives within App Service, so currently adding ASMC to the App Gateway resource is not possible.

I have relayed the feedback to our product engineering team.

Also, if you wish you may share your feedback on our Uservoice - All of the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure. Users with a similar request, can up-vote you post and add their comment.

Share via

How to make app service plan managed certificated for subject alternative names in azure?

1 answer

Your answer