Running az cdn custom-domain enable-https
on a domain having the HTTPS already enabled. Result: an internal misconfiguration and couple hours of downtime to first disable the custom domain and then enable it.
If you mean you did az cdn custom-domain enable-https
without the --custom-domain-https-parameters
parameter, then I believe that tells it to start following the Digicert automatic cert workflow. At least that's what it seemed to do for my domain when I tried it.
At the time this answer was originally written (2019 May), the az
CLI did not actually support that parameter even though the documentation already mentioned it. As of 2019 August, the CLI does support it, though how precisely to set it is still not documented. It may be a JSON object with the same schema as the REST API (see below), though it didn't work for the reporter of this GitHub issue.
The equivalent feature was added in 2019 March to the .Net SDK, though as of 2019 August there is no stable release of the Nuget package with that change.
It also isn't exposed by Azure PowerShell's Enable-AzCdnCustomDomainHttps
yet.
Saving the form resulted in no-downtime update of the certificate. Nice, but given automation and scripting, not really the way to go.
You can use one of the SDKs that supports the CustomDomainHttpsParameters
for the enableCustomHttps
endpoint, like the .Net SDK as I said above.
Or you can use the REST API directly as documented here, which is what I do for my own domain. POST
to https://management.azure.com/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Cdn/profiles/$cdnProfileName/endpoints/$cdnEndpointName/customDomains/$cdnCustomDomainName/enableCustomHttps?api-version=2018-04-02
with an application/json
body that looks like
{
"certificateSource": "AzureKeyVault",
"certificateSourceParameters": {
"@odata.type": "#Microsoft.Azure.Cdn.Models.KeyVaultCertificateSourceParameters",
"deleteRule": "NoAction",
"resourceGroupName": "$resourceGroupName",
"secretName": "$secretName",
"secretVersion": "$secretVersion",
"subscriptionId": "$subscriptionId",
"updateRule": "NoAction",
"vaultName": "$keyVaultName"
},
"protocolType": "ServerNameIndication"
}
The $secretVersion
is what would be different.
It follows standard REST semantics, in that it returns HTTP 202 Accepted
since it's a long-running async operation. It'll set the Location
header in the resonse, and you should GET
that URL repeatedly till it resolves to a success or failure status code.
Note that the portal also uses the REST API, so you can always derive this from just doing the steps in the portal UI and inspecting the network requests in your browser's developer tools. You will need to get your own oauth2 token, though (by creating an SP).
Aside: To save people the time it took me to discover this when trying to do this for my own domain, do not be fooled by the documentation or the example in the Azure Rest API specs repo. They imply the API version 2017-10-12
supports customHttpsParameters
, but in fact only 2018-04-02
and newer support it. If you use 2017-10-12
then the parameter is silently ignored, and it will try to use the Digicert automatic cert workflow.