使用Azure CLI将SSL证书从KeyVault绑定到WebApp

Question

当前，我们正在使用以下ARM模板将SSL证书绑定到WebApp，但是我们希望迁移到Azure CLI，但是如果不下载证书，就找不到找到此方法。

{
  "type": "Microsoft.Web/certificates",
  "name": "[variables('certificateName')]",
  "apiVersion": "2016-03-01",
  "location": "[resourceGroup().location]",
  "properties": {
    "keyVaultId": "[resourceId(parameters('existingKeyVaultResourceGroup'), 'Microsoft.KeyVault/vaults',parameters('existingKeyVaultId'))]",
    "keyVaultSecretName": "[parameters('existingKeyVaultSecretName')]",
    "serverFarmId": "[resourceId('Microsoft.Web/serverFarms',variables('hostingPlanName'))]"
  }
},
{
  "type": "Microsoft.Web/sites/hostnameBindings",
  "name": "[concat(variables('webAppName'), '/', variables('hostname'))]",
  "apiVersion": "2016-03-01",
  "location": "[resourceGroup().location]",
  "properties": {
    "sslState": "SniEnabled",
    "thumbprint": "[reference(resourceId('Microsoft.Web/certificates', variables('certificateName'))).Thumbprint]"
  },
  "dependsOn": [
    "[concat('Microsoft.Web/certificates/',variables('certificateName'))]"
  ]
}

Answer 1

这是官方网站上的示例脚本，如果您不想下载它，则应将其放在本地。

#!/bin/bash

fqdn=<replace-with-www.{yourdomain}>
pfxPath=<replace-with-path-to-your-.PFX-file>
pfxPassword=<replace-with-your=.PFX-password>
resourceGroup=myResourceGroup
webappname=mywebapp$RANDOM

# Create a resource group.
az group create --location westeurope --name $resourceGroup

# Create an App Service plan in Basic tier (minimum required by custom domains).
az appservice plan create --name $webappname --resource-group $resourceGroup --sku B1

# Create a web app.
az webapp create --name $webappname --resource-group $resourceGroup \
--plan $webappname

echo "Configure a CNAME record that maps $fqdn to $webappname.azurewebsites.net"
read -p "Press [Enter] key when ready ..."

# Before continuing, go to your DNS configuration UI for your custom domain and 
follow the 
# instructions at https://aka.ms/appservicecustomdns to configure a CNAME record for 
the 
# hostname "www" and point it your web app's default domain name.

# Map your prepared custom domain name to the web app.
az webapp config hostname add --webapp-name $webappname --resource-group 
$resourceGroup \
--hostname $fqdn

# Upload the SSL certificate and get the thumbprint.
thumbprint=$(az webapp config ssl upload --certificate-file $pfxPath \
--certificate-password $pfxPassword --name $webappname --resource-group 
$resourceGroup \
--query thumbprint --output tsv)

# Binds the uploaded SSL certificate to the web app.
az webapp config ssl bind --certificate-thumbprint $thumbprint --ssl-type SNI \
--name $webappname --resource-group $resourceGroup

echo "You can now browse to https://$fqdn"

希望这对您有帮助，如果您还有其他问题，请告诉我。

Answer 2

TLS / SSL->私钥证书->导入密钥库证书

任何人都可以共享arm / script进行配置。

手动地，我们申请去做，我们需要脚本来执行