rboelen/keyvault-certificate-rotation

Automatic updating of the Key Vault Certificate for Azure CDN / Front Door

keyvault-certificate-rotation

This application provides automatic updating of the Key Vault Certificate for Azure CDN / Front Door.

Simply set up an IAM to the Azure Key Vault and Azure CDN / Front Door where the certificate is stored, and it will be updated to the new version of the certificate within 24 hours.

Requirements

You will need the following:

• Azure Subscription (required to deploy this solution)
• Azure Key Vault
• Azure CDN / Front Door (pre-set up Key Vault certificates)

Getting Started

1. Deploy Application

2. Add access control (IAM) to Azure CDN / Front Door

Open the Access Control (IAM) of automatic updates target CDN Profile / Front Door or resource group containing the CDN Profile / Front Door, and assign the role of Contributor to the deployed application.

3. Add to Key Vault access policies

Open the access policy of the Key Vault and add the Certificate management access policy for the deployed application.

Limitations

Moving Key Vault to another subscription or resource group

Moving Key Vault to another subscription or resource group will result in certificate auto-renewal failing due to CDN / Front Door mismatch in association. After the move you need to manually set Key Vault certificate to the CDN / Front Door again.

See shibayan#13 (comment)

License

This project is licensed under the Apache License 2.0