Function App导入Azure Key Vault证书的ARM模板

Question

我有一个函数应用程序，它使用证书调用另一个 API。此证书 (.pfx) 文件已存在于密钥保管库中。我正在使用下面的 ARM 模板将证书导入函数应用程序的 SSL 设置。注意：当我删除部分 "hostNameSslStates" 时，函数应用程序可以正常部署。但是添加之后，我得到 - "Code": "Conflict", "Message": "带指纹的证书 'XXXXXXXX' 与主机名不匹配
'blobcreate-eventgridtrigger-functionapp.azurewebsites.net'.

ARM 模板资源部分- ` "resources"：[

    //StorageAccount
    {
        "type": "Microsoft.Storage/storageAccounts",
        "apiVersion": "2019-06-01",
        "name": "[parameters('storageAccounts_name')]",
        "location": "[resourceGroup().location]",
        "sku": {
            "name": "[parameters('storageSKU')]",
            "tier": "Standard"
        },
        "kind": "StorageV2",
        "properties": {
            "networkAcls": {
                "bypass": "AzureServices",
                "virtualNetworkRules": [],
                "ipRules": [],
                "defaultAction": "Allow"
            },
            "supportsHttpsTrafficOnly": true,
            "encryption": {
                "services": {
                    "file": {
                        "keyType": "Account",
                        "enabled": true
                    },
                    "blob": {
                        "keyType": "Account",
                        "enabled": true
                    }
                },
                "keySource": "Microsoft.Storage"
            },
            "accessTier": "Hot"
        }
    },

    //BlobService
    {
        "type": "Microsoft.Storage/storageAccounts/blobServices",
        "apiVersion": "2019-06-01",
        "name": "[variables('blobServiceName')]",
        "dependsOn": ["[variables('storageAccountResourceId')]"],
        "sku": {
            "name": "[parameters('storageSKU')]"//,
           // "tier": "Standard"
        },
        "properties": {
            "cors": {
                "corsRules": []
            },
            "deleteRetentionPolicy": {
                "enabled": false
            }
        }
    },

    //function app with server farm  

    //cert store access policies update-
    {
        "type": "Microsoft.KeyVault/vaults",
        "name": "testARMTemplateKeyVault",
        "apiVersion": "2016-10-01",
        "location": "[resourceGroup().location]",
        "properties": {
            "sku": {
                "family": "A",
                "name": "standard"
            },
            "tenantId": "c29678d0-eceb-4df2-a225-79cf795a6b64",
            "accessPolicies": [
                {
                    "tenantId": "tenantIdOfSubscription", //obtained from Get-AzTenant
                    "objectId": "objectid of Microsoft Azure App Service", //obtained from Get-AzADServicePrincipal 
                    "permissions": {
                        "keys": [
                            "Get",
                            "List",
                            "Update",
                            "Create",
                            "Import",
                            "Delete",
                            "Recover",
                            "Backup",
                            "Restore"
                        ],
                        "secrets": [
                            "Get",
                            "List",
                            "Set",
                            "Delete",
                            "Recover",
                            "Backup",
                            "Restore"
                        ],
                        "certificates": [
                            "Get",
                            "List",
                            "Update",
                            "Create",
                            "Import",
                            "Delete",
                            "Recover",
                            "ManageContacts",
                            "ManageIssuers",
                            "GetIssuers",
                            "ListIssuers",
                            "DeleteIssuers"
                        ],
                        "storage": []
                    }
                }
            ],
            "enabledForDeployment": false,
            "enabledForDiskEncryption": false,
            "enabledForTemplateDeployment": true,
            "enableSoftDelete": true
        }

    },

    {
        "type": "Microsoft.Web/serverfarms",
        "apiVersion": "2018-02-01",
        "name": "[variables('azurefunction_hostingPlanName')]",
        "location": "[resourceGroup().location]",
        "sku": {
            "name": "Y1",
            "tier": "Dynamic"
        },
        "properties": {
            "name": "[variables('azurefunction_hostingPlanName')]",
            "computeMode": "Dynamic"
            }
        },

        {
            "type": "Microsoft.Web/certificates",
            "name": "testingcert",
            "apiVersion": "2016-03-01",
            "location": "[resourceGroup().location]",
            "properties": {
                "keyVaultId": "[resourceId('Microsoft.KeyVault/vaults', 'testARMTemplateKeyVault')]",
                "keyVaultSecretName": "testingcert",
                "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('azurefunction_hostingPlanName'))]"
            }
        },

        {
        "apiVersion": "2018-11-01",
        "type": "Microsoft.Web/sites",
        "name": "[parameters('functionAppName')]",
        "location": "[resourceGroup().location]",
        "kind": "functionapp",
        "dependsOn": [
            "[variables('azureFunction_serverFarmResourceId')]",
            "[variables('storageAccountResourceId')]",
            "[resourceId('Microsoft.Web/certificates', 'testingcert')]"
        ],
        "properties": {
            "serverFarmId": "[variables('azureFunction_serverFarmResourceId')]",
            "siteConfig": {
                "appSettings": [
                    {
                    "name": "AzureWebJobsStorage",
                    "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', parameters('storageAccounts_name'), ';AccountKey=', listKeys(variables('storageAccountResourceId'),variables('storageAccountApiVersion')).keys[0].value)]"
                    },
                    {
                    "name": "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING",
                    "value": "[concat('DefaultEndpointsProtocol=https;AccountName=', parameters('storageAccounts_name'), ';AccountKey=', listKeys(variables('storageAccountResourceId'),variables('storageAccountApiVersion')).keys[0].value)]"
                    },
                    {
                    "name": "WEBSITE_CONTENTSHARE",
                    "value": "[toLower(parameters('functionAppName'))]"
                    },
                    {
                    "name": "FUNCTIONS_EXTENSION_VERSION",
                    "value": "~2"
                    },
                    {
                    "name": "WEBSITE_NODE_DEFAULT_VERSION",
                    "value": "~10"
                    },
                    {
                    "name": "APPINSIGHTS_INSTRUMENTATIONKEY",
                    "value": "[reference(resourceId('microsoft.insights/components/', parameters('functionApp_applicationInsightsName')), '2015-05-01').InstrumentationKey]"
                    },
                    {
                    "name": "FUNCTIONS_WORKER_RUNTIME",
                    "value": "dotnet"
                    },
                    {
                        "name": "WEBSITE_LOAD_CERTIFICATES",
                        "value": "required certificate thumprint"
                    }
                ]
            },
            "hostNameSslStates": [
                {
                    "name": "blobcreate-eventgridtrigger-functionapp.azurewebsites.net",//obtained from custom domains flatform features of the function app
                    "sslState": "SniEnabled",
                    "thumbprint": "[reference(resourceId('Microsoft.Web/certificates', 'testingcert')).Thumbprint]",
                    "toUpdate": true
                }
            ]
        }
    }
]`

Answer 1

好吧，错误很明显，您正在尝试为 blobcreate-eventgridtrigger-functionapp.azurewebsites.net 添加证书，但证书上的 dns 名称不匹配，因此出现错误。这可能不是添加证书的正确方法，除非它要用于 SSL 终止

Answer 2

在模板中添加证书部分 -

{
        "type": "Microsoft.Web/certificates",
        "name": "[parameters('CertificateName')]",
        "apiVersion": "2019-08-01",
        "location": "[resourceGroup().location]",
        "dependsOn": [
            "[concat('Microsoft.Web/serverFarms/', variables('azurefunction_hostingPlanName'))]"
        ],
        "properties": {
                "keyVaultId": "[parameters('keyvaultResourceId')]",
                "keyVaultSecretName": "[parameters('invoiceApiCertificateKeyVaultSecretName')]",
                "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('azurefunction_hostingPlanName'))]"
        }
    }

然后在函数 app-

中为此证书添加 dependsOn

[resourceId('Microsoft.Web/certificates', parameters('CertificateName'))]

Function App导入Azure Key Vault证书的ARM模板

ARM Template for Importing Azure Key Vault Certificate in Function App

azure-keyvault

arm-template

azure-function-app