使用 Azure SDK 从 Azure 函数中删除/重新绑定 SSL 证书

Question

I am trying to automate the process of obtaining an SSL certificate on my azure portal. For that I wrote an Azure function which downloads a new certificate and then uploads/binds it to my web app. The code looks like this:

        app.Update()
            .DefineSslBinding()
                .ForHostname("*.my.domain")
                .WithPfxCertificateToUpload(Path.Combine(executionContext.FunctionDirectory, "cert.pfx"), "pwd")
                .WithSniBasedSsl()
                .Attach()
            .Apply();

which is supposed to upload a new certificate and create a new binding. It works as expected on a web app without existing certificates/bindings but if I run the function again I have some problems:

1. The new certificate doesn't appear in the azure portal
2. The binding remains the same
3. If I manually remove the binding and run my code again it'll create the same binding with the very first certificate I had, ie becomes the same again
4. Funny thing: I don't receive any failure

After some researching I figured out that if I list my certificates in the azure cli with az webapp config ssl list the list on the portal is updated, ie all the certificates were there. But that doesn't help much.

My general question would be: is there any other way of rebinding a certificate?

Or, as an obvious workaround would be to remove an existing binding and the certificate beforeahead: how can I do the SSL certificate removal in an azure function using the .NET SDK?

Answer 1

Found the way.One should do this in 2 steps: first, upload a certificate with

        var certificate = await azure.AppServices.AppServiceCertificates
                .Define($"some-name")
                .WithRegion(app.Region)
                .WithExistingResourceGroup(app.ResourceGroupName)
                .WithPfxByteArray(pfxBytes)
                .WithPfxPassword("test")
                .CreateAsync();

and then using WithExistingCertificate :

        await app.Update()
            .DefineSslBinding()
                .ForHostname("*.my.domain")
                .WithExistingCertificate(certificate.Thumbprint)
                .WithSniBasedSsl()
                .Attach()
            .ApplyAsync();

There is a pending pull request in order to do that in a single call https://github.com/Azure/azure-libraries-for-net/pull/208

UPD: The PR was merged so instead of 2 calls you can simply use a single one:

var certBytes = certificateService.RetreiveCertificate();
webapp
    .Update()
    .DefineSslBinding()
    .ForHostname("my.hostname")
    .WithPfxByteArrayToUpload(certBytes, "password")
    .WithSniBasedSsl()
    .Attach()
    .Apply();