sjkp / letsencrypt-siteextension Goto Github PK

Azure Web App Site Extension for easy installation and configuration of Let's Encrypt issued SSL certifcates for custom domain names.

C# 85.41% CSS 0.64% PowerShell 2.88% Batchfile 0.77% HTML 10.24% ASP.NET 0.05%

azure letsencrypt azure-functions azure-webapp azure-webjob

letsencrypt-siteextension's Introduction

Important

You should migrate off this extension and instead use the free SSL certificates offered by Microsoft https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex#create-a-free-managed-certificate If you feel like you still need the extension, let me know why.

Let's Encrypt Site Extension

This Azure Web App Site Extension enables easy installation and configuration of Let's Encrypt issued SSL certificates for you custom domain names.

The site extension requires that you have configured a DNS entry for your custom domain to point to Azure Web App.

November 2019 - Microsoft finally acknowledge that maybe it is in due time that they add first level support for free SSL certificates, see this announcement about App Service Managed Certificates, be aware that it is in preview and currently doesn't support the apex/naked domain.

How to install

https://github.com/sjkp/letsencrypt-siteextension/wiki/How-to-install

Known Issues

This site-extension is NOT supported by Microsoft it is my own work based on https://github.com/fszlin/certes - this means don't expect 24x7 support, I use it for several of my own smaller sites, but if you are running sites that are important you should consider spending the few $ on a certificate and go with a Microsoft supported way of enabling SSL, so you have someone to blame :)
Note that Let's Encrypt works by providing automated certificates of a short (currently three month) duration. This extension is BETA SOFTWARE. You will need to keep this extension updated or risk losing SSL access when your certificate expires.
There are presently no email notifications for certificate renewal problems, but Lets Encrypt will email you weeks in advance of certificate expiration, when the extension is running properly the certificate should have been renewed before Let's Encrypt send the reminder email.
Due to rate limiting of Let's Encrypt servers, you can only request five certificates per domain name per week. Configuration errors or errors in this site extension may render you unable to retrieve a new certificate for seven days. If up-time is critical, have a plan for deploying a SSL certificate from another source in place.
No support for multi-region web apps, so if you use traffic manager or some other load balancer to route traffic between web apps in different regions please dont use this extension.
If you publish your project from Visual Studio with the "Delete Existing files" option, you will remove the web jobs the site extension uses to renew the certificate once they expire every 3 months (you can renew them manually or install the site extension again after publish).
The site-extension can now work with Azure App Service Local Cache, however you must do a little manual work, see https://github.com/sjkp/letsencrypt-siteextension/wiki/Azure-Function,-Multi-Region,-Local-Cache-support
If you use the "Run From Zip" deployment method, please take a look at this: #239 (comment)
Wildcard domains are not supported, (and will not be supposed in the site-extension), if you are interested in wildcard support check https://github.com/sjkp/letsencrypt-azure
If you have picked .net core as the runtime on a brand new web site, the extension will not work properly #349

How to troubleshoot

https://github.com/sjkp/letsencrypt-siteextension/wiki/Troubleshoot

This is Beta Software

Please take note that this Site-Extension is beta-software, so use at your own risk.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYLEFT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Semi-Automated Installation

With the semi-automated installation you manually add the site extension to your web app. Open the extension and manually click through the 3 step dialog.

Once this process is complete your custom domain for the site is setup with a Let's Encrypt issued SSL certificate.

Fully-Automated Installation

To use the Fully Automated Installation the following Web App settings must be added.

Key	Value
letsencrypt:Tenant	The tenant name e.g. myazuretenant.onmicrosoft.com
letsencrypt:SubscriptionId	The subscription id
letsencrypt:ClientId	The value of the clientid of the service principal
letsencrypt:ClientSecret	The secret for the service principal
letsencrypt:ResourceGroupName	The name of the resource group this web app belongs to
letsencrypt:ServicePlanResourceGroupName	The name of the resource group with the app service plan that hosts the web app, if the app service plan is in the same plan as the web app, then this property is optional.
letsencrypt:AcmeBaseUri	The url to Let's Encrypt servers e.g. https://acme-v02.api.letsencrypt.org/directory or https://acme-staging-v02.api.letsencrypt.org/directory (defaults to this)
letsencrypt:Email	The Email used for registering with Let's Encrypt
letsencrypt:Hostnames	Comma separated list of custom hostnames (externally hosted setup with CNames), that should automatically be configured for the site.
letsencrypt:WebRootPath	Use this setting, if you are not serving the website from site\wwwroot, then you can specify the other folder that serves your website here - should be in the format d:\home\site\wwwroot\public or where ever your files are located on the web server.
letsencrypt:DisableWebConfigUpdate	true / false, defaults to false, set this to true if you don't want the site extension to write the default webconfig to wwwroot.well-known\acme-challenge
letsencrypt:SiteSlot	Use this setting if you want to use the extension to setup SSL certificate for deployment slots, the value should be the name of the slot (and the extension should be installed in that slots kudu portal)
letsencrypt:UseIPBasedSSL	Set to true if you want to use IP Based SSL (required by some older clients). Defaults to false, which results in SNI.
letsencrypt:RenewXNumberOfDaysBeforeExpiration	Set to an integer defining the number of days before expiration the certificates should be renewed. Defaults to 22 days before expiration, as letencrypt sends reminder emails 20 days before
letsencrypt:AuthorizationChallengeBlobStorageAccount	(Optional) Set this setting to the connection string of a storage account, if you want to persist the http challenge file to an external azure blob storage, and serve it yourself when let's encrypt request it from the http://yourdomain/.well-known/acme-challenge/{filename} path. (Can be used when local file system cache is enabled or the web app is deployed to multiple region behind traffic manager etc.)
letsencrypt:AuthorizationChallengeBlobStorageContainer	Used in conjuction with letsencrypt:AuthorizationChallengeBlobStorageAccount if you want to specify the name of the container that is used, if not specified then letsencrypt-siteextension is used

As it can be seen from the list of App Settings a service principal is needed. The service principal must be assigned permissions to the web app, that is required as the extension use it for installing and updating the certificate. (If two resource groups are used, the app service principal must have access to both).

Besides the App Settings, the two Azure Web Job required connection strings AzureWebJobsStorage and AzureWebJobsDashboard must also exists, as the extension relies on an internal Web Job to renew the certificates once they expire.

To see an example of an ARM template installation look at azuredeploy.json

letsencrypt-siteextension's People

Contributors

Stargazers

Watchers

letsencrypt-siteextension's Issues

Possible race condition in Authorize

Changed the Sleep below from 4000 to 10000 and I'm getting staging certs reliably now. Solves #30 for me as well. I'm still having issues with production certs. After web.config is rewritten I'm getting error 304 on the challenge files for a few seconds while the server reconfigures.

// TODO: put timeout/retry limit in this loop
while (authzState.Status == "pending")
{
    Console.WriteLine(" Refreshing authorization");
    Trace.TraceInformation("Refreshing authorization");
    Thread.Sleep(10000); // this has to be here to give ACME server a chance to think
    ...

Certificate Revocation?

Is there a mechanism provided to revoke certificates?

I believe Let's Encrypt can revoke through the ACME client if one has the private key. Is that available for export in Azure Web Apps?

Let's Encrypt Documentation on Revocation:

Revoking a Certificate
The following command can be used to revoke a particular certificate.

$ certbot revoke --cert-path example-cert.pem

update arm template to use newer api version for appsettings

{
"apiVersion": "2015-08-01",
"name": "appsettings",
"type": "config",
"dependsOn": [
"[resourceId('Microsoft.Web/Sites', parameters('siteName'))]"
],
"properties": {
"SCM_SITEEXTENSIONS_FEED_URL": "https://www.siteextensions.net/api/v2/",
"letsencrypt:Hostnames": "[parameters('hostnames')]",
"letsencrypt:Email": "[parameters('email')]",
"letsencrypt:AcmeBaseUri": "https://acme-v01.api.letsencrypt.org/",
"letsencrypt:SubscriptionId": "[subscription().subscriptionId]",
"letsencrypt:Tenant": "[parameters('tenant')]",
"letsencrypt:ClientId": "[parameters('clientId')]",
"letsencrypt:ClientSecret": "[parameters('clientSecret')]",
"letsencrypt:ResourceGroupName": "[resourceGroup().name]"
}
},

Web publishing a project with "remove additional files at destination" deletes webjob

Publishing an MVC5 project with this option set deleted the letsencrypt webjob. Presumably "Exclude files from the App_Data" folder would have prevented this, but sometimes you get into issues that require a clean push.

Preventing this may be difficult. But a warning in the documentation and a recovery option that recreates the webjob would be great.

SetupHostNameAndCertificate job function fails

Though the entire process outcome it's succesfull (I have an SSL certificate generated by let's encrypt and assigned automatically to my website), the SetupHostNameAndCertificate job fails with the following message:

Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Exception while executing function: Functions.SetupHostNameAndCertificate ---> System.InvalidOperationException: Sequence contains no elements at System.Linq.Enumerable.First[TSource](IEnumerable1 source) at LetsEncrypt.SiteExtension.Core.CertificateManager.SetupHostnameAndCertificate() in C:\Projects\letsencrypt-siteextension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:line 63 at LetsEncrypt.SiteExtension.Functions.SetupHostNameAndCertificate(TimerInfo timerInfo) in C:\Projects\letsencrypt-siteextension\LetsEncrypt.SiteExtension.WebJob\Functions.cs:line 42 at lambda_method(Closure , Functions , Object[] ) at Microsoft.Azure.WebJobs.Host.Executors.VoidMethodInvoker1.InvokeAsync(TReflected instance, Object[] arguments) at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`1.d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__31.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__2c.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task) at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__13.MoveNext() --- End of inner exception stack trace --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__13.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__1.MoveNext()

Could not load File or assembly Newtonsoft.Json

My website blob logs are getting spammed with this every 60 ~~minutes~~ seconds on the dot.

2016-03-23T16:01:43,Error, ,07bfaa,635943457034371652,0,9192,6,"Unhandled Exception: System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=7.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies. The system cannot find the file specified. ---> System.IO.FileNotFoundException: Could not load file or assembly 'Newtonsoft.Json, Version=6.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed' or one of its dependencies. The system cannot find the file specified.",

I checked via FTP, and /SiteExtensions/letsencrypt64/bin contains Newtonsoft.Json.dll

MVC/ WebApi application can not expose .well-known directory for listing

I tried to add the following block in web.config to enable directory listing for /.well-known path

<location path=".well-known">
    <system.webServer>
      <directoryBrowse enabled="true" />
    </system.webServer>
  </location>

But I get the following error.

Configuration Error

Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: path attribute must be a relative virtual path. It cannot start with any of ' ' '.' '/' or ''.
Source Error:

Line 15:

Line 16:
Line 17:
Line 18: <system.webServer>
Line 19:

/letsencrypt throws BadImageFormatException

Could not load file or assembly 'LetsEncrypt.SiteExtension.Core' or one of its dependencies. An attempt was made to load a program with an incorrect format.

This was after I installed it on my web app. Stack trace:

[BadImageFormatException: Could not load file or assembly 'LetsEncrypt.SiteExtension.Core' or one of its dependencies. An attempt was made to load a program with an incorrect format.]
   System.Reflection.RuntimeAssembly._nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, RuntimeAssembly locationHint, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean throwOnFileNotFound, Boolean forIntrospection, Boolean suppressSecurityChecks) +0
   System.Reflection.RuntimeAssembly.InternalLoadAssemblyName(AssemblyName assemblyRef, Evidence assemblySecurity, RuntimeAssembly reqAssembly, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean throwOnFileNotFound, Boolean forIntrospection, Boolean suppressSecurityChecks) +234
   System.Reflection.RuntimeAssembly.InternalLoad(String assemblyString, Evidence assemblySecurity, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean forIntrospection) +108
   System.Reflection.RuntimeAssembly.InternalLoad(String assemblyString, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection) +25
   System.Reflection.Assembly.Load(String assemblyString) +34
   System.Web.Configuration.CompilationSection.LoadAssemblyHelper(String assemblyName, Boolean starDirective) +49

[ConfigurationErrorsException: Could not load file or assembly 'LetsEncrypt.SiteExtension.Core' or one of its dependencies. An attempt was made to load a program with an incorrect format.]
   System.Web.Configuration.CompilationSection.LoadAssemblyHelper(String assemblyName, Boolean starDirective) +772
   System.Web.Configuration.CompilationSection.LoadAllAssembliesFromAppDomainBinDirectory() +259
   System.Web.Configuration.CompilationSection.LoadAssembly(AssemblyInfo ai) +58
   System.Web.Compilation.BuildManager.GetReferencedAssemblies(CompilationSection compConfig) +224
   System.Web.Compilation.BuildManager.GetPreStartInitMethodsFromReferencedAssemblies() +76
   System.Web.Compilation.BuildManager.CallPreStartInitMethods(String preStartInitListPath, Boolean& isRefAssemblyLoaded) +139
   System.Web.Compilation.BuildManager.ExecutePreAppStart() +176
   System.Web.Hosting.HostingEnvironment.Initialize(ApplicationManager appManager, IApplicationHost appHost, IConfigMapPathFactory configMapPathFactory, HostingEnvironmentParameters hostingParameters, PolicyLevel policyLevel, Exception appDomainCreationException) +882

[HttpException (0x80004005): Could not load file or assembly 'LetsEncrypt.SiteExtension.Core' or one of its dependencies. An attempt was made to load a program with an incorrect format.]
   System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +579
   System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +118
   System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +660

My application is set up in 64-bit mode, is this going to be a problem?

Error when installing extension from scm on 64 bit environment

I have the following error "Could not load file or assembly 'ManagedOpenSsl' or one of its dependencies" after having installed the extension through scm, restarted the site and try to launch the extension.

Thanks

'authority' Uri should have at least one segment in the path (i.e. https://<host>/<path>/...)

Server Error in '/letsencrypt' Application.

'authority' Uri should have at least one segment in the path (i.e. https:////...)
Parameter name: authority

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.ArgumentException: 'authority' Uri should have at least one segment in the path (i.e. https:////...)
Parameter name: authority

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[ArgumentException: 'authority' Uri should have at least one segment in the path (i.e. https:////...)
Parameter name: authority]
Microsoft.IdentityModel.Clients.ActiveDirectory.Authenticator.DetectAuthorityType(String authority) +455
Microsoft.IdentityModel.Clients.ActiveDirectory.Authenticator..ctor(String authority, Boolean validateAuthority) +31
LetsEncrypt.SiteExtension.ArmHelper.GetWebSiteManagementClient(IAuthSettings model) in c:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\ArmHelper.cs:18
LetsEncrypt.SiteExtension.Controllers.HomeController.Hostname(String id) +59
lambda_method(Closure , ControllerBase , Object[] ) +104
System.Web.Mvc.ActionMethodDispatcher.Execute(ControllerBase controller, Object[] parameters) +14
System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary2 parameters) +157 System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary2 parameters) +27
System.Web.Mvc.Async.AsyncControllerActionInvoker.b__39(IAsyncResult asyncResult, ActionInvocation innerInvokeState) +22
System.Web.Mvc.Async.WrappedAsyncResult2.CallEndDelegate(IAsyncResult asyncResult) +29 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethod(IAsyncResult asyncResult) +32
System.Web.Mvc.Async.AsyncInvocationWithFilters.b__3d() +50
System.Web.Mvc.Async.<>c__DisplayClass46.b__3f() +225
System.Web.Mvc.Async.<>c__DisplayClass33.b__32(IAsyncResult asyncResult) +10
System.Web.Mvc.Async.WrappedAsyncResult1.CallEndDelegate(IAsyncResult asyncResult) +10 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethodWithFilters(IAsyncResult asyncResult) +34
System.Web.Mvc.Async.<>c__DisplayClass2b.b__1c() +26
System.Web.Mvc.Async.<>c__DisplayClass21.b__1e(IAsyncResult asyncResult) +100
System.Web.Mvc.Async.WrappedAsyncResult1.CallEndDelegate(IAsyncResult asyncResult) +10 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) +27
System.Web.Mvc.Controller.b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState) +13
System.Web.Mvc.Async.WrappedAsyncVoid1.CallEndDelegate(IAsyncResult asyncResult) +29 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +36
System.Web.Mvc.Controller.b__15(IAsyncResult asyncResult, Controller controller) +12
System.Web.Mvc.Async.WrappedAsyncVoid1.CallEndDelegate(IAsyncResult asyncResult) +22 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) +26
System.Web.Mvc.Controller.System.Web.Mvc.Async.IAsyncController.EndExecute(IAsyncResult asyncResult) +10
System.Web.Mvc.MvcHandler.b__5(IAsyncResult asyncResult, ProcessRequestState innerState) +21
System.Web.Mvc.Async.WrappedAsyncVoid1.CallEndDelegate(IAsyncResult asyncResult) +29 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) +28
System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.EndProcessRequest(IAsyncResult result) +9
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +9644037
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +155

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.6.1055.0

LogStream writes Error unable to parse WEBSITE_OWNER_NAME

I'm still in the proces why my cert is not generated in the last step of the creation interface (scm). One thing I noticed in the LogStream is the Error unable to parse WEBSITE_OWNER_NAME. If this is blocking, I'll mention it later. If this is a non-breaking issue. I suggest this Error is communicated as Warning.

doesn't tie certificate to website

Running mvc 5, followed directions from Nik Molar. Verified .wellknown/acme-challenge is browsable. Run through the scm Let's encrypt site extension and click on request and install certificate. Sometimes it shows certificate not found. Other times just stops processing. I go back to the main the page previous to the request and install certificate and I see certificates at the bottom of the page, but the list of of Hostname SSL bindings websites all show SSL state Disabled. I don't know where to go further to debug this. Running site extension version 0.47

SetupHostNameAndCertificate Fails

When trying to create and install a new certificate, the SetupHostNameAndCertificate webjob function fails with the following error:

Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Exception while executing function: Functions.SetupHostNameAndCertificate ---> System.InvalidOperationException: Sequence contains no elements at System.Linq.Enumerable.First[TSource](IEnumerable1 source) at LetsEncrypt.SiteExtension.Core.CertificateManager.SetupHostnameAndCertificate() in C:\Projects\letsencrypt-siteextension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:line 63 at LetsEncrypt.SiteExtension.Functions.SetupHostNameAndCertificate(TimerInfo timerInfo) in C:\Projects\letsencrypt-siteextension\LetsEncrypt.SiteExtension.WebJob\Functions.cs:line 42 at lambda_method(Closure , Functions , Object[] ) at Microsoft.Azure.WebJobs.Host.Executors.VoidMethodInvoker1.InvokeAsync(TReflected instance, Object[] arguments) at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`1.d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__31.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__2c.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task) at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__13.MoveNext() --- End of inner exception stack trace --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__13.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.d__1.MoveNext()

Extract subscription id and resource name from WEBSITE_OWNER_NAME variable

The WEBSITE_OWNER_NAME variable has format of subscriptionId+ResourceName-webspace

Trying to Generate a SSL certificate for a deployment slot with a custom domain

If you have a deployment slot with a custom domain (beta.yoursitename.com), setting up lets encrypt defaults to the parent application name and domains. You can not choose to generate a certificate for beta.yoursitename.com. Only for yoursitename.com.

We need to be able to change this behavior

(I know azure gives out one for yoursitenamebeta.azurewebsites.net, but a custom domain is much more convenient)

Certificate was not found

I followed Nik Molnar's instructions, and everything seemed fine until the final step: requesting and installing the certificate. This give the error and stack trace shown below.

The Azure portal doesn't show the new certificate, but if I run the site extension again then the certificate is shown in the list at the bottom of the /Home/Hostname page.

I've checked in /SiteExtensions/letsencrypt/config/httpsacme-v01.api.letsencrypt.org and in both the staging and production folders there are the 11 files you mention on Issue 18.

This looks similar to Issue #9 - is there a problem with having everything in one resource group?

Server Error in '/letsencrypt' Application.

Certificate 4F0D6A15CAAE0FAEAECADE6C7866CE118DE6A8DC was not found.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: Microsoft.Rest.Azure.CloudException: Certificate 4F0D6A15CAAE0FAEAECADE6C7866CE118DE6A8DC was not found.

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace: 


[CloudException: Certificate 4F0D6A15CAAE0FAEAECADE6C7866CE118DE6A8DC was not found.]
   Microsoft.Azure.Management.WebSites.<BeginCreateOrUpdateSiteWithHttpMessagesAsync>d__31.MoveNext() +5977
   System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +13847892
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +61
   Microsoft.Azure.Management.WebSites.<BeginCreateOrUpdateSiteAsync>d__53.MoveNext() +408
   System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +13847892
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +61
   Microsoft.Azure.Management.WebSites.SitesOperationsExtensions.BeginCreateOrUpdateSite(ISitesOperations operations, String resourceGroupName, String name, Site siteEnvelope, String skipDnsRegistration, String skipCustomDomainVerification, String forceDnsRegistration, String ttlInSeconds) +306
   LetsEncrypt.SiteExtension.Core.CertificateManager.Install(Target target, String pfxFilename, X509Certificate2 certificate) in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:488
   LetsEncrypt.SiteExtension.Core.CertificateManager.Auto(Target binding) in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:444
   LetsEncrypt.SiteExtension.Core.CertificateManager.RequestAndInstallInternal(Target target) in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:237
   LetsEncrypt.SiteExtension.Controllers.HomeController.Install(RequestAndInstallModel model) +697
   lambda_method(Closure , ControllerBase , Object[] ) +139
   System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary`2 parameters) +209
   System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary`2 parameters) +35
   System.Web.Mvc.Async.AsyncControllerActionInvoker.<BeginInvokeSynchronousActionMethod>b__39(IAsyncResult asyncResult, ActionInvocation innerInvokeState) +39
   System.Web.Mvc.Async.WrappedAsyncResult`2.CallEndDelegate(IAsyncResult asyncResult) +67
   System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethod(IAsyncResult asyncResult) +42
   System.Web.Mvc.Async.AsyncInvocationWithFilters.<InvokeActionMethodFilterAsynchronouslyRecursive>b__3d() +72
   System.Web.Mvc.Async.<>c__DisplayClass46.<InvokeActionMethodFilterAsynchronouslyRecursive>b__3f() +386
   System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethodWithFilters(IAsyncResult asyncResult) +42
   System.Web.Mvc.Async.<>c__DisplayClass2b.<BeginInvokeAction>b__1c() +30
   System.Web.Mvc.Async.<>c__DisplayClass21.<BeginInvokeAction>b__1e(IAsyncResult asyncResult) +186
   System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) +38
   System.Web.Mvc.Controller.<BeginExecuteCore>b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState) +29
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +65
   System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +53
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +36
   System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) +38
   System.Web.Mvc.MvcHandler.<BeginProcessRequest>b__5(IAsyncResult asyncResult, ProcessRequestState innerState) +44
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +65
   System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) +38
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +399
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +137

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.6.1055.0

possible issue with deployment slots

I can't seem to use the extension with this setup.

app service name: xxx
production slot (unnamed):
custom domain name: xxx.company.com
uat slot (name = uat)
custom domain name: xxx-uat.company.com

production slot works okay as the WEBSITE_SITE_NAME = xxx, so it pulls the correct custom domain name (xxx.company.com).

however, the uat slot has WEBSITE_SITE_NAME = xxx as well, so it's incorrectly pulling custom domain name xxx.company.com instead of xxx-uat.company.com

Did I miss something in the config?

Your extension SCM page shows certs for all my apps

Hi,
I started adding a cert for a second azure app. On the scm page of your extension for this second app, I am surprised to see the certs for the first app. Is it normal?

Incomplete certificate chain

Having successfully configured my site to use LetsEncrypt using this extension, the SSL Labs report says:

"This server's certificate chain is incomplete. Grade capped to B."

This is because the certificate "Let's Encrypt Authority X3" is an extra download.

Is there an easy workaround?

Publish Azure Web App from VSO deletes existing webjobs (including lets encrypt)

Can't figure out permissions

I'm getting the following exception after clicking "Request & Install Cert"
What am I missing?

The client 'XXXXXXX-cb8f-4c98-aee2-XXXXXXXX' with object id 'XXXXXX-cb8f-4c98-aee2-XXXXXX' does not have authorization to perform action 'Microsoft.Web/certificates/write' over scope '/subscriptions/XXXXXXX-8eb9-44c7-8a23-XXXXXXX/resourceGroups/xxxxxxx-Resources/providers/Microsoft.Web/certificates/xxxxx.xxxxxxxxx.com'.

Microsoft.Azure.Management.WebSites.<CreateOrUpdateCertificateWithHttpMessagesAsync>d__7.MoveNext() +3426 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +92 System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +58 Microsoft.Azure.Management.WebSites.<CreateOrUpdateCertificateAsync>d__5.MoveNext() +237 System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +92 System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +58 Microsoft.Azure.Management.WebSites.CertificatesOperationsExtensions.CreateOrUpdateCertificate(ICertificatesOperations operations, String resourceGroupName, String name, Certificate certificateEnvelope) +168 LetsEncrypt.SiteExtension.Core.CertificateManager.Install(Target target, String pfxFilename, X509Certificate2 certificate) in c:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:466 LetsEncrypt.SiteExtension.Core.CertificateManager.Auto(Target binding) in c:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:450 LetsEncrypt.SiteExtension.Core.CertificateManager.RequestAndInstallInternal(Target target) in c:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:244 LetsEncrypt.SiteExtension.Controllers.HomeController.Install(RequestAndInstallModel model) +604 lambda_method(Closure , ControllerBase , Object[] ) +104

Problems with certificate in mozilla / incomplete certificate chain

There are some problems with Azure webapp in mozilla.

Issued by CN is not trusted for mozilla.

'authority' Uri should have at least one segment in the path (i.e. https://<host>/<path>/...)

When configuring for the first time, ie. setting Tenant, Subscription, ClientId etc, and hit next, keep getting this error:

'authority' Uri should have at least one segment in the path (i.e. https://<host>/<path>/...)
Parameter name: authority

Server Error in '/letsencrypt' Application. The request was aborted: Could not create SSL/TLS secure channel.

Everything was going fine when I was going through the "Azure Let's Encrypt" setup until I hit "Request and Install Certificate" and I hit "Request and Install certificate". The page was working away and then threw the exception below. The .well-known folder was created. It is the 32bit version on a 32 bit site and is all contained in a single resource group.

Any ideas?

Server Error in '/letsencrypt' Application.

The request was aborted: Could not create SSL/TLS secure channel.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.

Source Error:

Stack Trace:

[WebException: The request was aborted: Could not create SSL/TLS secure channel.]
System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) +606
System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar) +64

[HttpRequestException: An error occurred while sending the request.]

[AggregateException: One or more errors occurred.]
System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions) +3632429
System.Threading.Tasks.Task1.GetResultCore(Boolean waitCompletionNotification) +11532455 System.Threading.Tasks.Task1.get_Result() +33
LetsEncrypt.SiteExtension.Core.CertificateManager.Authorize(Target target) in c:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:550
LetsEncrypt.SiteExtension.Core.CertificateManager.Auto(Target binding) in c:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:441
LetsEncrypt.SiteExtension.Core.CertificateManager.RequestAndInstallInternal(Target target) in c:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:244
LetsEncrypt.SiteExtension.Controllers.HomeController.Install(RequestAndInstallModel model) +605
lambda_method(Closure , ControllerBase , Object[] ) +104
System.Web.Mvc.ActionMethodDispatcher.Execute(ControllerBase controller, Object[] parameters) +14
System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary2 parameters) +169 System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary2 parameters) +27
System.Web.Mvc.Async.AsyncControllerActionInvoker.b__39(IAsyncResult asyncResult, ActionInvocation innerInvokeState) +22
System.Web.Mvc.Async.WrappedAsyncResult2.CallEndDelegate(IAsyncResult asyncResult) +29 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethod(IAsyncResult asyncResult) +32
System.Web.Mvc.Async.AsyncInvocationWithFilters.b__3d() +50
System.Web.Mvc.Async.<>c__DisplayClass46.b__3f() +225
System.Web.Mvc.Async.<>c__DisplayClass33.b__32(IAsyncResult asyncResult) +10
System.Web.Mvc.Async.WrappedAsyncResult1.CallEndDelegate(IAsyncResult asyncResult) +10 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeActionMethodWithFilters(IAsyncResult asyncResult) +34
System.Web.Mvc.Async.<>c__DisplayClass2b.b__1c() +26
System.Web.Mvc.Async.<>c__DisplayClass21.b__1e(IAsyncResult asyncResult) +100
System.Web.Mvc.Async.WrappedAsyncResult1.CallEndDelegate(IAsyncResult asyncResult) +10 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) +27
System.Web.Mvc.Controller.b__1d(IAsyncResult asyncResult, ExecuteCoreState innerState) +13
System.Web.Mvc.Async.WrappedAsyncVoid1.CallEndDelegate(IAsyncResult asyncResult) +29 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +36
System.Web.Mvc.Controller.b__15(IAsyncResult asyncResult, Controller controller) +12
System.Web.Mvc.Async.WrappedAsyncVoid1.CallEndDelegate(IAsyncResult asyncResult) +22 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) +26
System.Web.Mvc.Controller.System.Web.Mvc.Async.IAsyncController.EndExecute(IAsyncResult asyncResult) +10
System.Web.Mvc.MvcHandler.b__5(IAsyncResult asyncResult, ProcessRequestState innerState) +21
System.Web.Mvc.Async.WrappedAsyncVoid1.CallEndDelegate(IAsyncResult asyncResult) +29 System.Web.Mvc.Async.WrappedAsyncResultBase1.End() +49
System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) +28
System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.EndProcessRequest(IAsyncResult result) +9
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +9644037
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +155

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.6.1055.0

need to browse scm site to install certificate after creating site from arm template

It appears that the scm site doesn't get loaded from just creating the resource group from the template. So the certificate is not automatically installed until scm site is accessed. Have to test it more

Renew already fresh certificates?

Hi! Im not sure if i am making a mistake or not but my certs get renewed every time the jobs are executed. I see in the logs that it says "No certificates installed issued by Let's Encrypt that are about to expire within the next 14 days. Skipping."

But then i also found in the code: if (settings.Hostnames.Any()) on line 63 in CertificateManager.cs. Why is the method RequestAndInstallInternal ran if there are any hostnames? I mean, the foreach loop above should already take care of this, right? At least i think this might be the reason i get new certs all the time...

Configuration blocked

When I setup the extension and I click on "Request and Install Certificate", nothing happens (the post redirect to the same page and no SSL is installed).

Create and enable overwrite of letsencrypt:WebAppName to work with deployment slots

Firs of all, thanks for this amazing extension!

I guess this extension doesn't work with deployment slots because it gets the name of the main web app to use as WebAppName. If you create and enable overwrite of the letsencrypt:WebAppName it should work with deployment slots.

Can't install certificate on the final step

Here are the streaming logs of the error I get on /Home/Install. (staging checkbox enabled)

2016-01-21T11:11:52 PID[7808] Error Microsoft.Rest.Azure.CloudException: Certificate 9B2717DAAD8277293B74FDF906F36CB12C2E465F was not found.
at Microsoft.Azure.Management.WebSites.SitesOperations.d__31.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Management.WebSites.SitesOperationsExtensions.d__53.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Azure.Management.WebSites.SitesOperationsExtensions.BeginCreateOrUpdateSite(ISitesOperations operations, String resourceGroupName, String name, Site siteEnvelope, String skipDnsRegistration, String skipCustomDomainVerification, String forceDnsRegistration, String ttlInSeconds)
at LetsEncrypt.SiteExtension.Functions.Install(Target target, String pfxFilename, X509Certificate2 certificate)
at LetsEncrypt.SiteExtension.Functions.Auto(Target binding)
at LetsEncrypt.SiteExtension.Functions.RequestAndInstallInternal(Target target)

The thumbprint is visible on /Home/Hostname page, but invisible in the azure portal.

When site root url is not mapped to wwwroot, ACME Server is not able to resolve the Challange/Answer File

Most azure websites are default deployed to the wwwroot folder. For my case we are using different Application mappings and folders. Therefore the Answer resolving process is unable to complete because Azure Letsencrypt writes the Answer file to the wwwroot folder.

Suggestion 1: add an additional parameter to configuration screen to configure non-default local folder for the .wel-known folder deployment.

It does nothing...

This looks like a good idea, but when I click on "Request and Install certificate" it does nothing. It should at least display what is wrong.

Blank page when cert request fails

I added a new sub domain to my site and received a blank page after requesting the certificate. I couldn't recall if this was normal or an error. The issue turned out to be an inaccessible challenge directory, but the path to a solution was not clear.

Troubleshooting docs state:

Check that you can successfully browse /.well-known/acme-challenge/

I tripped over the obvious here as well. This directory is not browsable (nor should it be, of course). Suggest something like:

Verify that you can successfully browse /.well-known/acme-challenge/[name of challenge file] over http (not https). A list of challenge files is available via the SCM:

https://[your-site].scm.azurewebsites.net/api/vfs/LocalSiteRoot/VirtualDirectory0/site/wwwroot/.well-known/acme-challenge/

(You may need to change "VirtualDirectory0" as well depending on your hosting configuration.)

Thanks again for your work on this. Hopefully my fumbling can save others some time.

Error on installing certificate

Hi, first thank you to have enable the traces directly in the extension.

When I click on "request and install certificate", I have the following exception:

The remote server returned an error: (429) Unknown.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: System.Net.WebException: The remote server returned an error: (429) Unknown.

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace: 


[WebException: The remote server returned an error: (429) Unknown.]
   System.Net.HttpWebRequest.GetResponse() +1465
   ACMESharp.AcmeClient.RequestHttpPost(Uri uri, Object message) +642

[AcmeWebException: Unexpected error]
   ACMESharp.AcmeClient.RequestCertificate(String csrContent) +377
   LetsEncrypt.SiteExtension.Core.CertificateManager.GetCertificate(Target binding) in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:257
   LetsEncrypt.SiteExtension.Core.CertificateManager.Auto(Target binding) in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:374
   LetsEncrypt.SiteExtension.Core.CertificateManager.RequestAndInstallInternal(Target target) in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:225
   LetsEncrypt.SiteExtension.Controllers.HomeController.Install(RequestAndInstallModel model) +537

Certificate {Guid} was not found

Some things to know about my setup:
Updated to version 0.4.5
Using 64 bit
Using the same service principal and Storage account for other website secured with letsencrypt

Thanks

The webjob is running succesfully but no certificate downloaded or assigned

Hi,

Today I followed Nick Molnar's tutorial to use your extension and everything was setup correctly. I run your tool multiple time for different combination of domains and subdomains and I'm not getting any error but I'm not seeing any certificate downloaded or assigned in Azure portal for my website. The azure job is running succesfully, no errors, no issues but, as I've said, I don't have any certificate... Do I have any other places to check for errors or issues?

Thank you,
Evdin

Don't use obsolete methods from ACMESharp

var challenge = client.GenerateAuthorizeChallengeAnswer(authzState, AcmeProtocol.CHALLENGE_TYPE_HTTP);

GenerateAuthorizeChallengeAnswer <-- is obsolete

Can this be used with multiple app services sharing one storage account?

The question is pretty much in the title, but I am wondering if there would be any conflicts if I used one storage account for all app services using this site extension?

Or is it required that each site has its own storage account for this extension?

Certificates for multiple domains

Please, make it possible to request certificates for multiple domains (eg. www and non-www).

Failed on Step3 of Grant permissions to the Service Principal

We don't have Active directory already.
So I create a new active directory named webshoq. after that I create a new application named letsencrypt
On step3 I enter the name letsencrypt. I get an error message "There is no user in Standaardmap with the full name matching 'letsencrypt' "

The active directory "webshoq" in in the Standaardmap.

Shared cert between Multiple instances

If I had two instances of a site, one in the US and one in the EU then this extension would have to do multiple renewals. If I had enough instances this could go over the lets encrypt api limit.

It would be very useful to have the cert in blob and the webjobs to check there for a new cert.

Add a cert for www to an app that has already a cert for naked domain

For a second app, I realized that I could add the same cert for www and non-www domains. So I did it and it worked well.
I tried to come back to a first app where I had issued a cert only for the naked domain. This time I selected both www and non-www. When I hit the button to generate a cert (even in staging mode), nothing happens.

Nothing happens when requesting cert

I followed the step by step guide and everything seemed to go well, until the very last step.
When I click on "request and install certificate", the bowser spinner turns a few seconds, then stops and nothing changes on the page (well, in fact page reloads with same content). No mention of succes or failure. I try to go to my https://site but it says there is no cert.

Support for node.js

Need to check that the extension works with e.g. node express sites on azure.

https://community.letsencrypt.org/t/letsencrypt-on-azure/11540

Web-jobs instances (do I need one for each site?)

I have a question about webjobs instances and if one is required for each site. I have quite a few sites in a single resource group which all have the let's encrypt job. The thing is actually that now they don't all have said job because I have been messing around with continuous deployment and I've inadvertently delete some of them. At any rate I was wondering if just having one per resource group would be enough to pick up and renew certs. Maybe it would do this with a little extra configuration? I don't really want to run multiple versions of the same thing if one would suffice.

Thanks in advance

Step-by-step Guide

I've published a step-by-step guide for how to use this site extension, if you or the users of the project find it helpful: https://gooroo.io/GoorooTHINK/Article/16420/Lets-Encrypt-Azure-Web-Apps-the-Free-and-Easy-Way/

Support for Mobile Apps?

Hey,
is that supported? Can I add an SSL Cert this way to a Mobile App in Azure ? I cannot find the Extensions tab...

Works with asp.net core?

hi! I'm trying to use with asp.net core hello world... but i can't receive any error and nothing happens. I stuck at page "Request and Install Certificate", and after click "Request an Install certificate" it came back to same page.

Not Continuing after "Request and Install"

Hi,

I have everything configured (hopefully correctly), and am now trying to receive a certificate.
in the install window (/letsencrypt/Home/Install) i choose the domain, enter a mail and click the request button.
The site loads, but never forwarded to the domain window. When clicking the back button, all of the domains' SSL state is disabled.

However, in the WebJobs, I see 2 success jobs -

Functions.SetupHostNameAndCertificate
Functions.RenewCertificate

Both jobs have no output, but the state is marked "success".

Any tips on what I could be checking to get it to work?

Is it possible to delete certificates?

Hi.

I've had to delete and create a web app to move it from one app service plan to another (different regions). But now I can't install a new certificate on the new web app -> Exception: The resource 'xxx.yyy.zzz' already exists in location 'southcentralus' in resource group 'Default-WebApp-WestEurope'. A resource with the same name cannot be created in location 'West Europe'. Please select a new resource name.

Is there any way to delete existing certificates?

HostingEnvironment.MapPath("~") returning null?

WebJob function "Functions.RenewCertificate" fails with this exception:

Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Exception while executing function: Functions.RenewCertificate ---> System.TypeInitializationException: The type initializer for 'LetsEncrypt.SiteExtension.SettingsStore' threw an exception. ---> System.ArgumentNullException: Value cannot be null.
 Parameter name: path2
 at System.IO.Path.Combine(String path1, String path2)
 at LetsEncrypt.SiteExtension.SettingsStore..ctor() in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\SettingsStore.cs:line 29
 at LetsEncrypt.SiteExtension.SettingsStore..cctor() in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\SettingsStore.cs:line 14
 --- End of inner exception stack trace ---
 at LetsEncrypt.SiteExtension.SettingsStore.get_Instance() in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\SettingsStore.cs:line 17
 at LetsEncrypt.SiteExtension.Core.CertificateManager.RenewCertificate() in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:line 104
 at LetsEncrypt.SiteExtension.Functions.RenewCertificate(TimerInfo timerInfo) in C:\Projects\LetsEncrypt-SiteExtension\LetsEncrypt-SiteExtension\LetsEncrypt.SiteExtension.WebJob\Functions.cs:line 49
 at lambda_method(Closure , Functions , Object[] )
 at Microsoft.Azure.WebJobs.Host.Executors.VoidMethodInvoker`1.InvokeAsync(TReflected instance, Object[] arguments)
 at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`1.<InvokeAsync>d__0.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<ExecuteWithWatchersAsync>d__31.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<ExecuteWithLoggingAsync>d__2c.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<ExecuteWithLoggingAsync>d__13.MoveNext()
 --- End of inner exception stack trace ---
 at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<ExecuteWithLoggingAsync>d__13.MoveNext()
 --- End of stack trace from previous location where exception was thrown ---
 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<TryExecuteAsync>d__1.MoveNext()

I installed extension from gallery. Looks like exception happens here: https://github.com/sjkp/letsencrypt-siteextension/blob/master/LetsEncrypt.SiteExtension.Core/SettingsStore.cs#L29