Skip to content

Commit 8d1f690

Browse files
v-jaswelv-jaswel
committed
[ACA] [323626] Add CLI instructions for custom domain certificates.
1 parent 260daeb commit 8d1f690

File tree

2 files changed

+214
-22
lines changed

2 files changed

+214
-22
lines changed

‎articles/container-apps/custom-domains-certificates.md

Lines changed: 162 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,9 @@ author: craigshoemaker
66
ms.service: azure-container-apps
77
ms.custom: build-2023, ignite-2024
88
ms.topic: how-to
9-
ms.date: 05/28/2024
9+
ms.date: 12/18/2024
1010
ms.author: cshoe
11+
zone_pivot_groups: azure-cli-or-portal
1112
---
1213

1314
# Custom domain names and bring your own certificates in Azure Container Apps
@@ -24,6 +25,8 @@ Azure Container Apps allows you to bind one or more custom domains to a containe
2425
2526
## Add a custom domain and certificate
2627

28+
::: zone pivot="azure-portal"
29+
2730
> [!IMPORTANT]
2831
> If you are using a new certificate, you must have an existing [SNI domain certificate](https://wikipedia.org/wiki/Server_Name_Indication) file available to upload to Azure.
2932
@@ -113,6 +116,164 @@ Azure Container Apps allows you to bind one or more custom domains to a containe
113116
> [!NOTE]
114117
> For container apps in internal Container Apps environments, [additional configuration](./networking.md#dns) is required to use custom domains with VNET-scope ingress.
115118
119+
::: zone-end
120+
121+
::: zone pivot="azure-cli"
122+
123+
Container Apps supports apex domains and subdomains. Each domain type requires a different DNS record type and validation method.
124+
125+
| Domain type | Record type | Validation method | Notes |
126+
|--|--|--|--|
127+
| Apex domain | A record | HTTP | An apex domain is a domain at the root level of your domain. For example, if your DNS zone is `contoso.com`, then `contoso.com` is the apex domain. |
128+
| Subdomain | CNAME | CNAME | A subdomain is a domain that is part of another domain. For example, if your DNS zone is `contoso.com`, then `www.contoso.com` is an example of a subdomain that can be configured in the zone. |
129+
130+
1. Log in to Azure with the Azure CLI.
131+
132+
```azurecli
133+
az login
134+
```
135+
136+
1. Next, install the Azure Container Apps extension for the CLI.
137+
138+
```azurecli
139+
az extension add --name containerapp --upgrade
140+
```
141+
142+
1. Set the following environment variables. Replace the `<PLACEHOLDERS>` with your values.
143+
144+
```azurecli
145+
RESOURCE_GROUP = "<RESOURCE_GROUP>"
146+
CONTAINER_APP = "<CONTAINER_APP>"
147+
ENVIRONMENT = "<ENVIRONMENT>"
148+
TARGET_PORT = "<TARGET_PORT>"
149+
DOMAIN_NAME = "<DOMAIN_NAME>"
150+
CERTIFICATE_LOWERCASE_NAME = "<CERTIFICATE_LOWERCASE_NAME>"
151+
CERTIFICATE_LOCAL_PATH = "<CERTIFICATE_LOCAL_PATH>"
152+
CERTIFICATE_PASSWORD = "<CERTIFICATE_PASSWORD>"
153+
```
154+
155+
- Replace `<CERTIFICATE_LOCAL_PATH>` with the local path of your certificate file.
156+
- Replace `<CERTIFICATE_LOWERCASE_NAME>` with a lowercase certificate name that is unique within the environment.
157+
- Replace `<TARGET_PORT>` with the port that your container app is listening on.
158+
159+
1. Verify that your container app has HTTP ingress enabled.
160+
161+
```azurecli
162+
az containerapp ingress show \
163+
-n $CONTAINER_APP \
164+
-g $RESOURCE_GROUP
165+
```
166+
167+
If ingress isn't enabled, enable it with these steps:
168+
169+
```azurecli
170+
az containerapp ingress enable \
171+
-n $CONTAINER_APP \
172+
-g $RESOURCE_GROUP \
173+
--type external \
174+
--target-port $TARGET_PORT \
175+
--transport auto
176+
```
177+
178+
1. If you're configuring an apex domain, get the IP address of your Container Apps environment.
179+
180+
```azurecli
181+
az containerapp env show \
182+
-n $ENVIRONMENT \
183+
-g $RESOURCE_GROUP \
184+
-o tsv \
185+
--query "properties.staticIp"
186+
```
187+
188+
1. If you're configuring a subdomain, get the automatically generated domain of your container app.
189+
190+
```azurecli
191+
az containerapp show \
192+
-n $CONTAINER_APP \
193+
-g $RESOURCE_GROUP \
194+
-o tsv \
195+
--query "properties.configuration.ingress.fqdn"
196+
```
197+
198+
1. Get the domain verification code.
199+
200+
```azurecli
201+
az containerapp show \
202+
-n $CONTAINER_APP \
203+
-g $RESOURCE_GROUP \
204+
-o tsv \
205+
--query "properties.customDomainVerificationId"
206+
```
207+
208+
1. Using the DNS provider that is hosting your domain, create DNS records based on the record type you selected using the values shown in the *Domain validation* section. The records point the domain to your container app and verify that you own it. The setup depends on whether you are using custom domains with the private endpoint (preview) feature:
209+
210+
# [General](#tab/general)
211+
212+
- If you selected *A record*, create the following DNS records:
213+
214+
| Record type | Host | Value |
215+
|--|--|--|
216+
| A | `@` | The IP address of your Container Apps environment. |
217+
| TXT | `asuid` | The domain verification code. |
218+
219+
- If you selected *CNAME*, create the following DNS records:
220+
221+
| Record type | Host | Value |
222+
|--|--|--|
223+
| CNAME | The subdomain (for example, `www`) | The generated domain of your container app. |
224+
| TXT | `asuid.` followed by the subdomain (for example, `asuid.www`) | The domain verification code. |
225+
226+
# [Private endpoint](#tab/private-endpoint)
227+
228+
When using a private endpoint for your incoming traffic, you need to [create a private DNS zone](how-to-use-private-endpoint.md#configure-the-private-dns-zone).
229+
230+
- If you selected *A record*, create the following DNS records:
231+
232+
| Record type | Host | Value |
233+
|--|--|--|
234+
| A | `@` | The Private IP of your private endpoint on your container apps environment. |
235+
| TXT | `asuid` | The domain verification code. |
236+
237+
- If you selected *CNAME*, create the following DNS records:
238+
239+
| Record type | Host | Value |
240+
|--|--|--|
241+
| CNAME | The subdomain (for example, `www`) | The generated domain of your container app. |
242+
| TXT | `asuid.` followed by the subdomain (for example, `asuid.www`) | The domain verification code. |
243+
244+
---
245+
246+
1. Upload the certificate to your environment.
247+
248+
```azurecli
249+
az containerapp env certificate upload \
250+
-g $RESOURCE_GROUP \
251+
--name $ENVIRONMENT \
252+
--certificate-file $CERTIFICATE_LOCAL_PATH \
253+
--password $CERTIFICATE_PASSWORD \
254+
--certificate-name $CERTIFICATE_LOWERCASE_NAME
255+
```
256+
257+
1. Bind the certificate and domain to your container app.
258+
259+
```azurecli
260+
az containerapp hostname bind \
261+
--hostname $DOMAIN_NAME \
262+
-g $RESOURCE_GROUP \
263+
-n $CONTAINER_APP \
264+
--environment $ENVIRONMENT \
265+
--certificate $CERTIFICATE_LOWERCASE_NAME \
266+
--validation-method <VALIDATION_METHOD>
267+
268+
- If you're configuring an *A record*, replace `<VALIDATION_METHOD>` with `HTTP`.
269+
- If you're configuring a *CNAME*, replace `<VALIDATION_METHOD>` with `CNAME`.
270+
271+
It might take several minutes to issue the certificate and add the domain to your container app.
272+
273+
1. Once the operation is complete, navigate to your domain to verify that it's accessible.
274+
275+
::: zone-end
276+
116277
## Managing certificates
117278
118279
You can manage certificates via the Container Apps environment or through an individual container app.

‎articles/container-apps/custom-domains-managed-certificates.md

Lines changed: 52 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: craigshoemaker
66
ms.service: azure-container-apps
77
ms.custom: build-2023, devx-track-azurecli, ignite-2024
88
ms.topic: how-to
9-
ms.date: 09/19/2024
9+
ms.date: 12/18/2024
1010
ms.author: cshoe
1111
zone_pivot_groups: azure-cli-or-portal
1212
---
@@ -110,45 +110,72 @@ Container Apps supports apex domains and subdomains. Each domain type requires a
110110
az extension add --name containerapp --upgrade
111111
```
112112
113+
1. Set the following environment variables. Replace the `<PLACEHOLDERS>` with your values.
114+
115+
```azurecli
116+
RESOURCE_GROUP = "<RESOURCE_GROUP>"
117+
CONTAINER_APP = "<CONTAINER_APP>"
118+
ENVIRONMENT = "<ENVIRONMENT>"
119+
TARGET_PORT = "<TARGET_PORT>"
120+
DOMAIN_NAME = "<DOMAIN_NAME>"
121+
CERTIFICATE_LOWERCASE_NAME = "<CERTIFICATE_LOWERCASE_NAME>"
122+
CERTIFICATE_LOCAL_PATH = "<CERTIFICATE_LOCAL_PATH>"
123+
CERTIFICATE_PASSWORD = "<CERTIFICATE_PASSWORD>"
124+
```
125+
126+
- Replace `<CERTIFICATE_LOCAL_PATH>` with the local path of your certificate file.
127+
- Replace `<CERTIFICATE_LOWERCASE_NAME>` with a lowercase certificate name that is unique within the environment.
128+
- Replace `<TARGET_PORT>` with the port that your container app is listening on.
129+
113130
1. Verify that your container app has HTTP ingress enabled.
114131
115132
```azurecli
116-
az containerapp ingress show -n <CONTAINER_APP_NAME> -g <RESOURCE_GROUP_NAME>
133+
az containerapp ingress show \
134+
-n $CONTAINER_APP \
135+
-g $RESOURCE_GROUP
117136
```
118137
119138
If ingress isn't enabled, enable it with these steps:
120139
121140
```azurecli
122-
az containerapp ingress enable -n <CONTAINER_APP_NAME> -g <RESOURCE_GROUP_NAME> \
123-
--type external --target-port <TARGET_PORT> --transport auto
141+
az containerapp ingress enable \
142+
-n $CONTAINER_APP \
143+
-g $RESOURCE_GROUP \
144+
--type external \
145+
--target-port $TARGET_PORT \
146+
--transport auto
124147
```
125148
126-
Replace `<CONTAINER_APP_NAME>` with the name of your container app, `<RESOURCE_GROUP_NAME>` with the name of the resource group that contains your container app, and `<TARGET_PORT>` with the port that your container app is listening on.
127-
128149
1. If you're configuring an apex domain, get the IP address of your Container Apps environment.
129150
130151
```azurecli
131-
az containerapp env show -n <ENVIRONMENT_NAME> -g <RESOURCE_GROUP_NAME> -o tsv --query "properties.staticIp"
152+
az containerapp env show \
153+
-n $ENVIRONMENT \
154+
-g $RESOURCE_GROUP \
155+
-o tsv \
156+
--query "properties.staticIp"
132157
```
133158
134-
Replace `<ENVIRONMENT_NAME>` with the name of your environment, and `<RESOURCE_GROUP_NAME>` with the name of the resource group that contains your environment.
135-
136159
1. If you're configuring a subdomain, get the automatically generated domain of your container app.
137160
138161
```azurecli
139-
az containerapp show -n <CONTAINER_APP_NAME> -g <RESOURCE_GROUP_NAME> -o tsv --query "properties.configuration.ingress.fqdn"
162+
az containerapp show \
163+
-n $CONTAINER_APP \
164+
-g $RESOURCE_GROUP \
165+
-o tsv \
166+
--query "properties.configuration.ingress.fqdn"
140167
```
141168
142-
Replace `<CONTAINER_APP_NAME>` with the name of your container app, and `<RESOURCE_GROUP_NAME>` with the name of the resource group that contains your container app.
143-
144169
1. Get the domain verification code.
145170
146171
```azurecli
147-
az containerapp show -n <CONTAINER_APP_NAME> -g <RESOURCE_GROUP_NAME> -o tsv --query "properties.customDomainVerificationId"
172+
az containerapp show \
173+
-n $CONTAINER_APP \
174+
-g $RESOURCE_GROUP \
175+
-o tsv \
176+
--query "properties.customDomainVerificationId"
148177
```
149178
150-
Replace `<CONTAINER_APP_NAME>` with the name of your container app, and `<RESOURCE_GROUP_NAME>` with the name of the resource group that contains your container app.
151-
152179
1. Using the DNS provider that is hosting your domain, create DNS records based on the record type you selected using the values shown in the *Domain validation* section. The records point the domain to your container app and verify that you own it. The setup depends on whether you are using custom domains with the private endpoint (preview) feature:
153180
154181
# [General](#tab/general)
@@ -190,19 +217,23 @@ Container Apps supports apex domains and subdomains. Each domain type requires a
190217
1. Add the domain to your container app.
191218
192219
```azurecli
193-
az containerapp hostname add --hostname <DOMAIN_NAME> -g <RESOURCE_GROUP_NAME> -n <CONTAINER_APP_NAME>
220+
az containerapp hostname add \
221+
--hostname $DOMAIN_NAME \
222+
-g $RESOURCE_GROUP \
223+
-n $CONTAINER_APP_NAME
194224
```
195225
196-
Replace `<DOMAIN_NAME>` with the domain name you want to add, `<RESOURCE_GROUP_NAME>` with the name of the resource group that contains your container app, and `<CONTAINER_APP_NAME>` with the name of your container app.
197-
198226
1. Configure the managed certificate and bind the domain to your container app.
199227
200228
```azurecli
201-
az containerapp hostname bind --hostname <DOMAIN_NAME> -g <RESOURCE_GROUP_NAME> -n <CONTAINER_APP_NAME> --environment <ENVIRONMENT_NAME> --validation-method <VALIDATION_METHOD>
229+
az containerapp hostname bind \
230+
--hostname $DOMAIN_NAME \
231+
-g $RESOURCE_GROUP_NAME \
232+
-n $CONTAINER_APP_NAME \
233+
--environment $ENVIRONMENT_NAME \
234+
--validation-method <VALIDATION_METHOD>
202235
```
203236
204-
Replace `<DOMAIN_NAME>` with the domain name you want to add, `<RESOURCE_GROUP_NAME>` with the name of the resource group that contains your container app, `<CONTAINER_APP_NAME>` with the name of your container app, and `<ENVIRONMENT_NAME>` with the name of your environment.
205-
206237
- If you're configuring an *A record*, replace `<VALIDATION_METHOD>` with `HTTP`.
207238
- If you're configuring a *CNAME*, replace `<VALIDATION_METHOD>` with `CNAME`.
208239

0 commit comments

Comments
 (0)