Add feature to automatically update App Service hostname bindings with management

[m8rmclaren]

Azure App Service resources can be configured to use custom domains and TLS certificates to secure them. Azure's turnkey solution to manage App Service TLS certificates is to purchase a certificate through Azure App Service Certificate Orders. When a certificate is purchased through Azure App Service Certificate Orders, the certificate is automatically added to the Key Vault associated with the App Service resource. The certificate is also automatically added to the App Service resource's hostname bindings. If a certificate was already purchased through Azure App Service Certificate Orders, Azure Key Vault automatically rotates and otherwise manages the certificate and its usage. However, if a certificate is obtained in another way and then imported into an Azure Key Vault, Azure will not assist in the management of the certificate, including automatic updating of App Service hostname bindings, which is not ideal. This is where the Keyfactor Azure Key Vault integration can help. For example, a certificate may be used within an organization for multiple purposes, including for TLS on an Azure App Service.

When the "AutoUpdateBindings" option is enabled, the Keyfactor Azure Key Vault extension will automatically find App Services with bound hostnames that match the certificate's DNS SANs and update the hostname bindings. Then, when the certificate is EOL, Keyfactor will automatically remove the TLS bindings and remove the App Service Certificate's reference to Azure Key Vault and associated Key Vault certificate entry. Furthermore, if Keyfactor is configured to automatically renew certificates, the workflow for removing and re-adding bindings is handled automatically.

This feature is designed to be constrained to the permissions set for the service principal used. Specifically, the extension can only update hostname bindings for App Services inside Resource Groups that the Service Principal has access to. For example, if App Services exist in a resource group outside of the desired scope of management, the extension will not update the bindings for those resources.

To enable this feature, create Access Policies to grant read permission to the Microsoft.Azure.WebSites and Microsoft.Azure.CertificateRegistration resource providers, also shown below:

• Microsoft Azure App Service/Microsoft.Azure.WebSites
  • Object ID: abfa0a7c-a6b6-4736-8310-5855508787cd (Same for all Azure subscriptions)
  • Object ID: 6a02c803-dafd-4136-b4c3-5a6f318b4714 (Azure Government cloud environments)
• Microsoft.Azure.CertificateRegistration
  • Object ID: ed47c2a1-bd23-4341-b39c-f4fd69138dd3

To access App Services resources, the service principal created for the Keyfactor Azure Key Vault extension needs to have maintain permissions over any resource groups that contain App Services resources that will be managed by Keyfactor. This can be done by adding the service principal to any desired resource group access policies (IAM).

This feature is characterized by the following architecture diagrams: