Use the certbot client to generate and install certificates in Azure.

Currently it supports authentication with Azure DNS and installation to Azure App Gateway.

Before starting you need:

• An Azure account and the Azure CLI installed.
• Certbot installed locally.

The easiest way to install both the certbot client and the certbot-azure plugin is:

pip install certbot-azure

If you are in Mac OS you will need a local set up for Python and we recommend a virtual environment. You might also need to install dialog: brew install dialog.

If you are in Ubuntu you will need to install pip and other libraries:

apt-get install python-pip python-dev libffi-dev libssl-dev libxml2-dev libxslt1-dev libjpeg8-dev zlib1g-dev dialog

And then run pip install certbot-azure.

To generate a certificate and install it in an Azure App Gateway first generate your credentials:

az ad sp create-for-rbac \
--name Certbot --sdk-auth \
--role "DNS Zone Contributor" \
--scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_ID \
> mycredentials.json

Then generate the certificate:

certbot certonly -d REPLACE_WITH_YOUR_DOMAIN \
-a dns-azure --dns-azure-credentials mycredentials.json \
--dns-azure-resource-group <REPLACE_WITH_RESOURCE_GROUP>

Follow the screen prompts and you should end up with the certificate in your distribution. It may take a couple minutes to update.

To generate a certificate and install it in an Azure App Gateway first generate your credentials:

az ad sp create-for-rbac \
--name Certbot --sdk-auth \
--scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_ID \
> mycredentials.json

Then generate and install the certificate (this example uses Azure DNS for authentication):

certbot -d REPLACE_WITH_YOUR_DOMAIN \
-a dns-azure --dns-azure-credentials mycredentials.json \
--dns-azure-resource-group <REPLACE_WITH_RESOURCE_GROUP> \
-i azure_agw --certbot-azure-ag:installer-credentials mycredentials.json \
--azure-agw-resource-group <REPLACE_WITH_RESOURCE_GROUP> \
--azure-agw-app-gateway-name <REPLACE_WITH_APP_GATEWAY_NAME>

Follow the screen prompts and you should end up with the certificate in your distribution. It may take a couple minutes to update.

To automate the renewal process without prompts (for example, with a monthly cron), you can add the certbot parameters --renew-by-default --text