You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Azure App Service task is built to deploy to either a "web-app" or a "function" via Azure App Service.
7
+
8
+
You need a working web-app or function app and an Application User setup using Azure AD, with a corresponding Secret. The info you need to collect for an Azure Application User credential is Directory/Tenant ID, Application/Client ID, Client Secret: (which you need to add using Azure AD and which you need to remind yourself to renew/update periodically).
9
+
10
+
- Ideally start with a working managed certificate, you will likely find that Azure requires a password to be set on the PFX that will be imported, so set that under Certificate > Advanced > Signing & Security - Security (scroll down for the option). Select *Request Certificate* again to re-build the certificate with the password set.
11
+
12
+
- Add the *Deploy to Azure App Service* task under Tasks for your managed certificate.
13
+
14
+
- On the *Task Parameters* tab, select/add the Azure App Service Credential you want to use to authenticate to the App Service, and the Azure App Service you want to deploy to. To add a stored credential, click "New" next to the credentials dropdown list to save new app login details
15
+
16
+
- Save the managed certificate and then click the ▶️ play button next to the task to run it. You should see a success message in the task log.
17
+
18
+
- Subsequent automated renewals will also run the deployment task after the renewal has completed successfully.
Copy file name to clipboardExpand all lines: docs/deployment/tasks/tomcat.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
id: tomcat
3
-
title: Apache Tomcat
3
+
title: Deployment Task - Apache Tomcat
4
4
---
5
5
6
6
Specific configuration of Apache Tomcat for individual requirements is outside of the scope of this documentation however the following is a suggested (working) configuration process for a default install of Tomcat 9.0:
Copy file name to clipboardExpand all lines: docs/deployment/tasks_intro.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,26 +16,26 @@ If you need to perform more custom steps using the certificate, or if you just w
16
16
17
17
You may wish to run a custom task before you renew your certificate. For instance, you may wish to to make automated firewall changes or call a custom Web Hook/API. These are called 'Pre-Request Tasks'.
18
18
19
-
## Post-Request (Deployment) Tasks
19
+
## Deployment Tasks
20
20
21
-
You may want to run any number of tasks after you have renewed your certificate or after it has been automatically deployed. For instance, running scripts, exporting for different server types (Apache, nginx), copying to remote servers etc. These are called 'Deployment Tasks'.
21
+
You may want to run any number of tasks after you have renewed your certificate or after it has been automatically deployed. For instance, running scripts, exporting for different server types (Apache, nginx), copying to remote servers etc. These are called 'Deployment Tasks' or Post-Request Tasks.
22
22
23
23
### Task Triggers
24
24
25
25
You can configure a task to run either when a certificate request was successful or on error, or you can opt to run the task manually.
26
26
27
27
Manually running a task is useful when you want to avoid restarting a service outside of maintenance hours, or if you wish to run the tasks from the command line, a script or a scheduled task. Example command line arguments are shown in the UI to help with scripting.
28
28
29
-
## Task Types
29
+
### Built-in Task Types
30
30
31
31
Built-in deployment task types, each with UI to configure the task parameters etc, include:
32
32
33
33
34
34
| Name | Description |
35
35
|---|---|
36
36
| Deploy Certificate to ADFS ||
37
-
| Deploy to Apache Tomcat| Export the certificate as a pkcs12 key store for use with Apache Tomcat. See [more details](./tasks/tomcat.md). |
38
-
| Deploy to Azure App Service| Note that setting a PFX password (Certificate> Advanced > Signing & Security) is required for this deployment. |
37
+
|[Deploy to Apache Tomcat](./tasks/tomcat.md)| Export the certificate as a pkcs12 key store for use with Apache Tomcat. |
38
+
|[Deploy to Azure App Service](./tasks/azure-app-service.md)| Note that setting a PFX password (Certificate> Advanced > Signing & Security) is required for this deployment. |
39
39
| Deploy to Azure Key Vault||
40
40
| Deploy to Centralized Certificate Store (CCS)||
41
41
| Deploy to Microsoft Exchange| Apply the certificate to a local MS Exchange services and apply it to an optional list of services (IMAP, SMTP, IIS, POP etc). |
@@ -9,9 +9,20 @@ When requesting a certificate from a [Certificate Authority (CA)](certificate-au
9
9
10
10
In the case of ACME domain validated certificates this CSR mainly just includes the list of domains you want to include on the certificate (other fields such as Organisation etc are discarded because ACME doesn't validate these). The CSR is signed using your Private Key, verifiable using the public key included in the CSR. This ensures that the same entity who completed certificate validation is also the same entity submitting the certificate signing request.
11
11
12
+
## OCSP Must-Staple
13
+
To enable OCSP-Must staple check *Require OCSP Must-Staple* under Certificate > Advanced > Signing & Security. This will add the OCSP Must Staple extension to the CSR and the resulting certificate.
14
+
15
+
## CSR Signing Key Algorithm (Private Key)
16
+
Before version 6.x the app uses RSA 2048 for CSR signing keys (the certificate Private Key), but this has been changed to ECDSA P256 in version 6.x onwards. You can set your preference per-managed certificate under Certificate > Advanced > Signing & Security > CSR Signing Algorithm.
17
+
18
+
## Re-use a Private Key
19
+
In most cases you will want to use a new private key for each certificate request, but in some cases you may want to re-use an existing private key. For example, if you have a private key that is already in use by another system, or you have a private key that you want to use for multiple certificates. If you check *Use the same Private Key for Renewals* the app will generate a key on next renewal and re-use that for subsequent renewals of the same certificate.
20
+
21
+
You can also use a custom private key in PEM format, by selecting *Choose Private Key...* under Certificate > Advanced > Signing & Security > CSR Signing Key.
22
+
12
23
## Using a Custom CSR
13
24
In most cases the CSR (and private key) is generated for you, but in some cases you may need to supply your own, so that the resulting certificate can be used with other systems which require a CSR based workflow (such as SAP, various servers and IoT devices including printers etc).
14
25
15
-
- Click New Certificate, then in Certificate - Advanced > Signing & Security, Choose Custom CSR.
26
+
- Click New Certificate, then in Certificate > Advanced > Signing & Security, Choose Custom CSR.
16
27
- Select your CSR file, then select your Private key file. The private key file is required in order to build the final certificate PFX.
17
28
- Click Request Certificate. This will perform the certificate request with the ACME CA and submit your CSR, a signed certificate will then be downloaded.
Copy file name to clipboardExpand all lines: docs/renewals.md
+6-3Lines changed: 6 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,11 +5,14 @@ title: Certificate Renewals
5
5
6
6
All certificates have an expiry date, after which they cannot be used to secure communication. Certificates from Let's Encrypt expire after 90 days, so for that reason renewals need to happen often, and if there's going to be a problem with validation that will prevent the renewal, you need to know in advance of the certificate expiry.
7
7
8
-
**By default, Certify will attempt to auto-renew your certificates.**
8
+
**By default, Certify will attempt to auto-renew your certificates and tell you if something goes wrong**
9
9
10
-
If the process fails repeatedly, **it will try to notify you**(unless you have disabled the option) before certificate expiration becomes a problem. Set your 'Certificate Authority Account' under Settings > Certificate Authorities > Edit to a real, monitored, email address preferably accessible by others if you are a group of site administrators.
10
+
If the renewal process fails repeatedly, **it will try to notify you**via our API before certificate expiration becomes a problem, unless you have disabled the *Enable Status Reports to Dashboard* option under Settings. **Ensure that your 'Certificate Authority Account' under Settings > Certificate Authorities is set to a real, monitored, email address** preferably accessible by others if you are a group of site administrators. You do not need to configure anything else like SMTP relays etc. to use this feature, it's all automatic by default.
11
11
12
-
In addition, as your certificate approaches expiration, Let's Encrypt will also email you. This can also happen if you have changed a certificate (for instance to add more domains to it) so you may get emails for expiring certificates you have since replaced.
12
+
In addition, as your certificate approaches expiration, the certificate authority (such as Let's Encrypt) will also email you. This can also happen if you have changed a certificate (for instance to add more domains to it) so you may get emails for expiring certificates you have since replaced.
13
+
14
+
## Dashboard
15
+
You can optionally send a notification to the https://certifytheweb.com dashboard when a renewal is successful or fails. This is useful if you have multiple administrators and want to be notified when a renewal fails. You can also see the status of all your certificates on the dashboard. To get started with sending reports to the Dashboard, select the *Add to Dashboard* option from the start up screen of the app on your machine.
0 commit comments