Propagating renewed certs into App Gateway SSL configuration? about keyvault-acmebot HOT 3 CLOSED

Following up ... after a lot of back-and-forth with Microsoft support, I think that we've identified the cause of the problem I had. I'm posting it here for posterity.

The issue was that the way that I was using the UI to select the KeyVault certificate, the App Gateway was specifically selecting the current active version of the SSL certificate, not the ongoing series of certificates. In particular, the "KeyVault secret id" that was getting stored was something of the form:

https://{vaultname}.vault.azure.net/secrets/{certname}/{version-hexdigest}

To get the cert to auto-renew, the version hexdigest needs to be removed, for a secret ID of:

https://{vaultname}.vault.azure.net/secrets/{certname}/

As of now (July 2020), it doesn't seem possible to configure this in the Azure Portal UI, but I think it can be done using the az CLI program using a preview-status command-line argument:

az network application-gateway ssl-cert update \
  -g $resource_group_name \
  --gateway-name $gateway_name \
  -n $gw_cert_name \
  --key-vault-secret-id https://${vault_name}.vault.azure.net/secrets/${vault_cert_name}/

It'll be another month since my cert auto-renews and I can confirm that this solution works, but I'm pretty confident this will have solved my problem.

from keyvault-acmebot.

No. According to the Application Gateway documentation, when a Key Vault certificate is renewed, it will automatically renew within 24 hours.

The instances also poll Key Vault at 24-hour intervals to retrieve a renewed version of the certificate, if it exists. If an updated certificate is found, the SSL certificate currently associated with the HTTPS listener is automatically rotated.
https://docs.microsoft.com/en-us/azure/application-gateway/key-vault-certs

If your Key Vault certificate has been renewed, but App Gateway certificate has not been automatically renewed, you may want to contact Azure support.

from keyvault-acmebot.

Thanks for the prompt response. I'll close this issue since my problem doesn't look like something that keyvault-acmebot is responsible for.

from keyvault-acmebot.