Automating App Service certificate domain verification

[Jobin Jose (jobinjosem1)]

We are trying to automate the creation of Azure App service certificates. We are able to create the certificate order and certificate using Bicep. Once the cert is created we need to add a txt record to the domain for verification. Is there a way to get the TXT record value corresponding to the created certificate by referring to any output values? In the current scenario, we copy the value manually from the portal, but we would like to get it using CLI. Can anyone help me with this?

var rgname = 'test-rg'
var kvname = 'test-keyvault'

resource rg 'Microsoft.Resources/resourceGroups@2021-04-01' existing = {
name: rgname
scope: subscription()
}

resource kv 'Microsoft.KeyVault/vaults@2021-10-01' existing = {
name: kvname
scope: resourceGroup(rgname)
}

resource cer 'Microsoft.CertificateRegistration/certificateOrders@2021-03-01' = {
name: 'test'
location: 'global'
properties: {
productType: 'StandardDomainValidatedSsl'
autoRenew: false
validityInYears: 1
distinguishedName: 'CN=test.acme.come'
}
}

resource symbolicname 'Microsoft.CertificateRegistration/certificateOrders/certificates@2021-03-01' = {
name: 'test-cert-order'
location: 'global'
kind: 'string'
parent: cer
properties: {
keyVaultId: kv.id
keyVaultSecretName: 'test-cert-secret'
}
}

[Ben Wilkinson (brwilkinson)]

I would like to test this, however I am not in a position to make any cert request at this time.

Here are the API's..

https://docs.microsoft.com/en-us/rest/api/appservice/app-service-certificate-orders/retrieve-certificate-actions
https://docs.microsoft.com/en-us/rest/api/appservice/app-service-certificate-orders/verify-domain-ownership

If you execute those, does it return the txt DNS record information?

I guess the first one will return the DNS info that you need. Let me know and I will consider purchasing a new certificate to test this out.

[Ben Wilkinson (brwilkinson)]

okay never mind, I figured that I could spin up the request without getting charged...

so I was able to figure out the answer.. as follows

resource certOrder 'Microsoft.CertificateRegistration/certificateOrders@2021-03-01' = {
  name: cert.name
  location: 'global'
  properties: {
    distinguishedName: 'CN=${cert.domainDNS}'
    validityInYears: 1
    keySize: 2048
    productType: bool(cert.wildcard) ? 'StandardDomainValidatedWildCardSsl': 'StandardDomainValidatedSsl'
    autoRenew: true
  }
}

// resource certOrderKV 'Microsoft.CertificateRegistration/certificateOrders/certificates@2021-03-01' = {
//   name: cert.name
//   parent: certOrder
//   location: 'global'
//   properties: {
//     keyVaultId: KV.id
//     keyVaultSecretName: cert.name
//   }
// }

output certOrderInfo string = certOrder.properties.domainVerificationToken

Once you have the domain verification token, then you can create the TXT record in the root domain that you are using on the cert.

If you are looking for some assistance to create the txt record in Azure DNS Zone, just let me know.

[Ben Wilkinson (brwilkinson)]

here are the samples:

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/AppServiceCert.bicep
https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/AppServiceCert-Request.bicep
https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.DNS.Public.TXT.bicep

input is:

        "AppServiceCertRequestInfo" : [
          {
            "name": "Contoso-Wildcard",
            "domainName": "contoso.com",
            "domainDNS": "*.contoso.com",
            "wildcard": 1
          }
        ]

[Ben Wilkinson (brwilkinson)]

One thing that I did not account for is how to manage the lifecycle of this, to stop it executing writing the DNS txt record every time, rather than skipping updating the DNS Etc. However this should get you started.

[Ben Wilkinson (brwilkinson)]

Hi Jobin Jose (@jobinjosem1)
I figured I should tag you on this one in case you missed the reply. Let me know if this works for you?

[Ben Wilkinson (brwilkinson)]

Since the certOrder.properties.domainVerificationToken is available, I am confident this should work, so will mark this as answered for now, however please feel free to reply with any more updates or questions/comments.