As of 2021-04-05, Azure CDN can be told to use the "Latest" version of a particular KeyVault certificate. I haven't found any news of this change, but it was added to the documentation with this commit.
In order for the certificate to be automatically rotated to the latest version when a newer version of the certificate is available in your Key Vault, please set the certificate/secret version to 'Latest'. If a specific version is selected, you have to re-select the new version manually for certificate rotation. It takes up to 24 hours for the new version of the certificate/secret to be deployed.
In the portal, this can be done by choosing the "Latest" option in the "Certificate/Secret version" dropdown. With the Azure CLI, this can be done with:
az cdn custom-domain enable-https \
--resource-group "$cdnResourceGroupName" \
--profile-name "$cdnProfileName" \
--endpoint-name "$cdnEndpointName" \
--name "$cdnCustomDomainName" \
--user-cert-subscription-id "$subscriptionId" \
--user-cert-group-name "$keyVaultResourceGroupName" \
--user-cert-vault-name "$keyVaultName" \
--user-cert-secret-name "$secretName" \
--user-cert-protocol-type 'sni'
Notice that this command does not set the --user-cert-secret-version
parameter, which is how you select the "Latest" functionality.
For anyone who wants to do it manually, the old answer of doing this manually is below.
Running az cdn custom-domain enable-https
on a domain having the HTTPS already enabled. Result: an internal misconfiguration and couple hours of downtime to first disable the custom domain and then enable it.
As of 2021-04-05, this can be done with the Azure CLI with:
az cdn custom-domain enable-https \
--resource-group "$cdnResourceGroupName" \
--profile-name "$cdnProfileName" \
--endpoint-name "$cdnEndpointName" \
--name "$cdnCustomDomainName" \
--user-cert-subscription-id "$subscriptionId" \
--user-cert-group-name "$keyVaultResourceGroupName" \
--user-cert-vault-name "$keyVaultName" \
--user-cert-secret-name "$secretName" \
--user-cert-secret-version "$secretVersion" \
--user-cert-protocol-type 'sni'
(When this answer was originally written in 2019 May, the Azure CLI documented a --custom-domain-https-parameters
parameter that implied it could be used for this purpose. If the parameter was not supplied, the CLI would run the CDN-managed cert workflow (cert issued by DigiCert). However, it was never properly documented how to actually use the parameter. As of 2021 March, the parameter was removed from the CLI again. Finally, as of 2021 April, the --user-cert-*
parameters have been added.)
The equivalent feature was added in 2019 March to the .Net SDK,. So the Nuget package should allow you to use user-managed certs.
As of 2021 April, Azure PowerShell's Enable-AzCdnCustomDomainHttps
commandlet still does not support user-managed certs, only CDN-managed certs.
Or you can use the REST API directly as documented here. Make a POST
request to https://management.azure.com/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Cdn/profiles/$cdnProfileName/endpoints/$cdnEndpointName/customDomains/$cdnCustomDomainName/enableCustomHttps?api-version=2018-04-02
with an application/json
body that looks like
{
"certificateSource": "AzureKeyVault",
"certificateSourceParameters": {
"@odata.type": "#Microsoft.Azure.Cdn.Models.KeyVaultCertificateSourceParameters",
"deleteRule": "NoAction",
"resourceGroupName": "$resourceGroupName",
"secretName": "$secretName",
"secretVersion": "$secretVersion",
"subscriptionId": "$subscriptionId",
"updateRule": "NoAction",
"vaultName": "$keyVaultName"
},
"protocolType": "ServerNameIndication"
}
$resourceGroupName
and $keyVaultName
identify the KeyVault. $secretName
and $secretVersion
identify the certificate. (Don't be confused if the Portal doesn't show any secrets in your KeyVault; a KeyVault certificate with a private key is implicitly a KeyVault secret with the same name and version.)
This API endpoint follows standard REST semantics, in that it returns HTTP 202 Accepted
since it's a long-running async operation. It'll set the Location
header in the response, and you should GET
that URL repeatedly till it resolves to a success or failure status code.
Note that the portal also uses the REST API, so you can always derive this from just doing the steps in the portal UI and inspecting the network requests in your browser's developer tools. You will need to get your own oauth2 token, though (by creating an SP).
Aside: To save people the time it took me to discover this when trying to do this for my own domain, do not be fooled by the documentation or the example in the Azure Rest API specs repo. They imply the API version 2017-10-12
supports customHttpsParameters
, but in fact only 2018-04-02
and newer support it. If you use 2017-10-12
then the parameter is silently ignored, and it will try to use the Digicert automatic cert workflow.