azure-cli: az webapp config ssl bind results in error when webapp is in different rg than app service plan
Description
az webapp config ssl bind
command fails with: certificate “xyz” not found when pfx cert is uploaded to webapp in different resource group than app service plan
To Reproduce Create App Service Plan in resource group ‘A’ Create WebApp ‘myApp’ on Plan in new resource group ‘B’ Upload .pfx cert to WebApp
az webapp config ssl list --resource-group 'B'
#This shows certificate with thumbprint ‘xyz’ found
az webapp config ssl bind --certificate-thumbprint 'xyx' --ssl-type SNI --name 'myApp' --resource-group 'B'
#Results in Error certificate ‘xyz’ not found
–debug shows az webapp config ssl bind
is searching for pfx cert in resource group ‘A’ where the AppService plan is located.
.pfx cert is actually located in resource group ‘B’ alongside WebApp.
Expected behavior Command should run successfully.
Uploaded private key certs are located in the rg of the WebApp they are initially uploaded to. Uploaded private key certs can be shared across all WebApps in the same App Service Plan regardless of resource group.
Suggested Fix:
az webapp config ssl bind
should search for a certificate with matching a thumbprint in all resource groups containing WebApps of the parent App Service Plan to the bind target.
Workaround Uploading the .pfx cert to a WebApp in the same resource group as the App Service Plan works as expected.
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Comments: 37 (10 by maintainers)
closing this based on comments that 2.0.77 works from above plus we have plans to update SSL commands& work on making help better as a part of those changes. Thanks!
This shouldn’t be closed as same problem exists in: az version { “azure-cli”: “2.17.1”, “azure-cli-core”: “2.17.1”, “azure-cli-telemetry”: “1.0.6”, “extensions”: { “ai-examples”: “0.2.5”, “azure-cli-ml”: “1.19.0” } }
I have found a workaround for this which is to use the generic “az resource” which allows you to jump in and do things via the API directly. This is not an API bug as this works very basic for illustration only:
az webapp config hostname add {yourAppDomainToBind e.g. mydomain.com} az webapp config ssl upload {certUploadParams} az resource update --ids “{WebAppID}/hostNameBindings/{yourAppDomainToBind e.g. mydomain.com}?api-version=2019-08-01” --set properties.thumbprint={certThumprint} --set properties.sslState=SniEnabled
You need to pass both --set params or nothing will be set e.g. you cannot just send certThumprint only hoping to see it updated but not active for test though you could set it to Disabled explicitly. Replace SniEnabled with IPBasedEnabled or Disabled as suits need as per: https://docs.microsoft.com/en-us/rest/api/appservice/webapps/createorupdatehostnamebinding
Why is this closed
What is status of this issue. As I can see it is close however in version:
It still does not work.
My scenario according to your comment:
Its fail with comment:
When I try to execute:
then error:
Also upload certificate to app service plan:
fails with error:
Is there any progres to resolve this issue?
No seriously why is this closed
Hi I am also getting this issue, As of writing this I am using the latest version of the cli with powershell 7
I manually added the certificate via the portal and I am now trying to reference using the thumbprint I obtained from the portal.
I am running the following command:
az webapp config ssl bind --certificate-thumbprint $thumbprint --ssl-type SNI --name $app --resource-group $rg --subscription $sub
If I use the ASP resource group I get this error, I have edited the names:
{"error":{"code":"ResourceNotFound","message":"The Resource 'Microsoft.Web/sites/my-web-app' under resource group 'my-web-app-resource-group' was not found."}}
If I use the Web App resource group I get this:
Certificate for thumbprint 'the thumbprint' not found.
Thank you @MarkPerry24. You just saved me updating a whole bunch of web apps manually.
@panchagnula
The Webapp one.
Using the Asp RG would produce the following error: {“error”:{“code”:“ResourceNotFound”,“message”:“The Resource ‘Microsoft.Web/sites/MyWebapp2139102312’ under resource group ‘AspRG’ was not found.”}}
You can see the full script I am using below:
Repo I have linked above includes the throwaway cert used https://github.com/owenmather/az-webapp-bind-err-demo