Issue with Web App certificate & ssl binding

There is an issue when attempting to create and bind a certificate to a web app when the webapp is in a different resource group to the App Service Plan.

The following code works when both are in the same resource group, however it fails when they are in different resource groups.

var webApp = await azure.WebApps.GetByIdAsync(webAppId); webApp.Update() .DefineSslBinding() .ForHostname(domainName) .WithPfxCertificateToUpload(certFileName, cert.Password) .WithSniBasedSsl() .Attach() .DefineSslBinding() .ForHostname("www." + domainName) .WithPfxCertificateToUpload(certFileName, cert.Password) .WithSniBasedSsl() .Attach() .Apply();

The error message is “: Microsoft.Rest.Azure.CloudException: Certificate XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX was not found.”

When using the resource explorer, I can see the certificate has been uploaded to the Web App resource group instead of the App Service Plan resource group:

https://resources.azure.com/subscriptions/sub-id/resourceGroups/webapp-resourcegroup/providers/Microsoft.Web/certificates

So when the actual binding of the domain name to the ssl cert occurs, the certificate isn’t there so the above error is given.

[ghost]

A fully working workaround is this:

var webApp = ...;
foreach (var hostName in webApp.HostNameSslStates))
{
    var appServicePlan = await _azure.Instance.AppServices.AppServicePlans.GetByIdAsync(webApp.AppServicePlanId);
    await webApp.Manager.AppServiceCertificates
        .Define(string.Format("{0}##{1}#", thumbprint, appServicePlan.Region.Name))
            .WithRegion(webApp.Region)
            .WithExistingResourceGroup(appServicePlan.ResourceGroupName)
            .WithPfxFile(GetCertPath(domainName))
            .WithPfxPassword(_certificatePassword)
        .CreateAsync();

    hostName.Value.Thumbprint = thumbprint;
    hostName.Value.ToUpdate = true;
}
await webApp.Update().ApplyAsync();
await webApp.RefreshAsync(); // I'm not sure whether this is needed

[Linkens]

@sagoo33 Yep ! This checks out !

In hindsight, Not that weird to use the appservice plan ressource name to upload the cert. But it would be nice to have this in the documentation of the library. If app ressource group is different from app service plan’s, it will definitely lead to this ‘Not Found’ behavior if you are not careful where you upload. Therefore the Azure credentials used must have access to both resource group