AutoHttps.Azure 1.1.0

AutoHttps.Azure

Azure support for AutoHttps: dns-01 challenges through Azure DNS, and certificate and account key storage in Key Vault. Use either part, or both.

dotnet add package AutoHttps.Azure

DNS challenges through Azure DNS

Every validated domain must live in the configured zone.

Azure DNS keeps every TXT value at a name in one record set, and a wildcard with its apex, or another client ordering for the same name, puts more than one value at _acme-challenge. The provider adds its value to whatever is there and later removes only that value, deleting the set only when nothing else is left in it. Each write is conditional on the set's etag, so a value another client adds in between is not overwritten.

builder.Services.AddAutoHttps(options =>
{
    options.DomainNames.Add("*.example.com");
    options.DomainNames.Add("example.com");
    options.EmailAddress = "admin@example.com";
    options.AcceptTermsOfService = true;
    options.PreferredChallengeType = "dns-01";
})
.UseAzureDns(dns =>
{
    dns.SubscriptionId = "00000000-0000-0000-0000-000000000000";
    dns.ResourceGroupName = "dns-rg";
    dns.ZoneName = "example.com";
});

Storage in Key Vault

builder.Services.AddAutoHttps(options => { /* ... */ })
    .UseAzureKeyVault(vault => vault.VaultUri = new Uri("https://myvault.vault.azure.net/"));

Certificates and the account key are stored as secrets. Key Vault names allow only letters, digits and hyphens, so each store identifier becomes a sanitised name with a hash of the original appended, which keeps distinct identifiers from colliding.

Every vault soft-deletes, so a secret you delete, for example to force a new certificate, keeps its name in the vault's recycle bin and blocks a new secret of that name. AutoHttps recovers it and then writes the new value over it, which needs the Recover permission on secrets (Key Vault Secrets Officer has it).

Credentials

Both parts use DefaultAzureCredential by default, which resolves a managed identity, environment variables, or the Azure CLI. Set ClientId alone to pick a user-assigned managed identity, which a host with several of them needs. Set TenantId, ClientId and ClientSecret together to use a service principal instead. Setting only some of them is refused at startup rather than quietly signing in as someone else. The identity needs DNS Zone Contributor on the zone, and Key Vault Secrets Officer on the vault.

Options

AzureDnsOptions: SubscriptionId, ResourceGroupName, ZoneName (all required), RecordTtlSeconds (default 60), and the credential fields.

AzureKeyVaultOptions: VaultUri (required), SecretPrefix (default autohttps-), and the credential fields. SecretPrefix may contain only letters, digits and hyphens and is at most 30 characters, so the Key Vault secret name stays within its 127-character limit; both are checked at startup.