Shared cert between Multiple instances about letsencrypt-siteextension HOT 7 OPEN

That is a fair request - I would probably go with keyvault in that case. Don't expect me to get around to it within the next couple of weeks though.

from letsencrypt-siteextension.

KeyVault is a reasonable alternative.

Also thinking, if we had multiple instances with multiple installations then all webjobs will attempt to renew the cert at the same time.

Might be worth adding a setting to prevent them from attempting to renew.

from letsencrypt-siteextension.

@TWith2Sugars thanks for the concern, that shouldn't be an issue however, as the timeredtrigged that is used, already takes care of only running one job at any time (i think it uses azure blob storage for locking) https://github.com/Azure/azure-webjobs-sdk-extensions#timertrigger

from letsencrypt-siteextension.

Even better :)

I have found 1 odd edge case with regards to traffic managed sites.

In my above example the EU server made a request for a cert but the US instance was challenged.

How would we get round this?

from letsencrypt-siteextension.

Hmm - I should probably ensure that the challenge files are places on all web frontends. But good point., i just tested on a single instance.

from letsencrypt-siteextension.

I have tagged this with wontfix for now.
Because when using traffic manager it gets complicated to ensure the acme-challenge files is placed on all web frontends. In that type of setup it would probably be better with a solution that would use the DNS challenge instead of the http challenge. Unfortunately I can't think of an easy way to build the DNS challenge into the extension (it is at a minimum going to involve some manual DNS configuration). Right now that scenario is probably only for the most advanced use cases, and in many of those I would be reluctant to use Lets Encrypts certificates in the first place, as solutions that require a global footprint probably are of such high importance that they should just spend the money on a real certificate and use a Microsoft supported way of enabling SSL.

from letsencrypt-siteextension.

Old thread, but is this still the case? Similar situation here but DNS is unfortunately not an option.

from letsencrypt-siteextension.