如何使用Let's Encrypt为自定义域设置SSL Generator

Question

I want to setup SSL Certificates generator/manager for Custom Domains - using Let's Encrypt but I'm not able to find the right tutorial. I've done some research work and I'm able to setup Let's Encrypt Certbot on one domain/machine with nginx.

I have a web app on Azure which will serve multiple domains, so multiple custo domains from single IP. I want to generate SSL Certificates for custom domains on the fly.

I learnt that Openresty can help but I couldn't find any step-by-step article. How do I setup the SSL Management with Let's Encrypt. At this point I'm not sure if I need a stand-alone VM or if it possible to run as a set of REST API Endpoint on a Web Server? Any pointers? I appreciate any help!

Answer 1

Azure App Service does not currently include native support for Let's Encrypt, but there is a community-supported extension that gets the job done.

https://github.com/sjkp/letsencrypt-siteextension/wiki/How-to-install

This extension uses a webjob to facilitate automatic certificate renewal, so the app must be Always On for automatic renewal to work. If you are using deployment slots, be aware that you need to install the extension in each slot, and then add a WEBJOBS_STOPPED = 1 slot setting to each non-production slot (assuming you're not using other webjobs on non-production slots that need to run in their non-production environments). This ensures that the webjob is always present on the production slot, and only runs on the production slot.

Also be aware that if you Web Deploy code to the app service from Visual Studio with the "Remove additional files at destination" file publish option checked, that doing so will remove the webjob from the slot to which you publish. You have a few choices if this applies to you:

1. Manually refresh the certificates every three months.
2. Reinstall the extension any time you publish (you do not have to reconfigure it).
3. Clone the webjob into your solution and publish it along with your project.

There may be other options, but those are the ones I've explored.

Microsoft has asserted that this extension constitutes support for Let's Encrypt, but Microsoft does not support this extension. Here's a place to vote for native support for Let's Encrypt on Azure if you think it's important:

https://feedback.azure.com/forums/170024-additional-services/suggestions/16957756-add-integration-with-let-s-encrypt