This function provide easy automation of Let's Encrypt for Azure Key Vault. This project started to solve some problems.

• Store certificates securely with Key Vault
• Centrally manage many certificates with one Key Vault
• Simple deployment and configuration
• Robustness of implementation
• Easy monitoring (Application Insights, Webhook)

Use Key Vault for secure and centralized management of Let's Encrypt certificates.

• Feature Support
• Requirements
• Getting Started
• Usage
• Thanks
• License

• All Azure App Service (Web Apps / Functions / Containers, any OS)
• Azure CDN / Front Door
• Azure Application Gateway v2
• Subject Alternative Names (SANs) certificates (multi-domains support)
• Wildcard certificates

• Azure Subscription
• Azure DNS and Key Vault resource
• Email address (for Let's Encrypt account)

• LetsEncrypt:SubscriptionId
  • Azure Subscription Id
• LetsEncrypt:Contacts
  • Email address for Let's Encrypt account
• LetsEncrypt:VaultBaseUrl
  • Azure Key Vault DNS name (Only when using an existing Key Vault)
• LetsEncrypt:Webhook
  • Webhook destination URL (optional, Slack recommend)

Open Authentication / Authorization from Azure Portal and turn on App Service Authentication. Then select Log in with Azure Active Directory as an action when not logging in.

Set up Azure Active Directory provider by selecting Express.

Assign DNS Zone Contributor role to Azure DNS zone or Resource Group.

Add the created Azure Function to the Key Vault Certificate management access policy.

Go to https://YOUR-FUNCTIONS.azurewebsites.net/add-certificate. Since the Web UI is displayed, if you select the target DNS zone and input domain and execute it, a certificate will be issued.

If nothing is displayed in the dropdown, the IAM setting is incorrect.

Select "Import Key Vault Certificate" button to import the certificate from Key Vault into App Service.

After that, the certificate will automatically be renewed from Key Vault.

• https://docs.microsoft.com/en-us/azure/application-gateway/key-vault-certs

• https://docs.microsoft.com/en-us/azure/cdn/cdn-custom-ssl?tabs=option-2-enable-https-with-your-own-certificate
• https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https#option-2-use-your-own-certificate

• ACMESharp Core by @ebekker
• Durable Functions by @cgillum and contributors
• DnsClient.NET by @MichaCo

This project is licensed under the Apache License 2.0