How to create a ceritifcate using Lets Encrypt, Powershell and Azure

By Madis Kõosaar
lets-encrypt azure powershell

How to create a ceritifcate using Lets Encrypt, Powershell and Azure

Pre-Requierements

  • Powershell
  • Powershell module ´Posh-ACME´
  • DNS provider Domain
  • Azure DevOps account
  • Azure Key Vault

Add Posh-acme module to powershell

  1. Install-Module -Name Posh-ACME -Scope AllUsers
  2. Import-Module Posh-ACME

Generate verification TXT record for DNS

  1. Generate TXT using following command in powershell: New-PACertificate '*.yourdomain.com' -AcceptTOS -Contact your emaik@address.com -Friendlyname "*.yourdomain.com" -PfxPass "SomePassWord" -DNSSleep 120

TXT example

  1. Then in your DNS service provider create a txt endpoint with _achme-challenge.yourdomain.com and the value from.
  2. After the value is created in the service provider press continue in your Powershell window.
  3. Once that tool finishes go to C:\Users\YourUser\AppData\Local\Posh-ACME\ and follow the folder structure to get the certificate cert.pfx

Upload certificate to Azure

  1. Go to your Azure portal
  2. If you don’t have Key Vault then you need to create one.
    1. To do that create new resource and search for Key vault and follow instructions.
  3. Go to your Key Vault

Key valut

  1. Click on Generate/Import and choose import i. If you there is a certificate existing then click on that and Import a new version using the password, that you used when creating the certificate through the CLI was generated
  2. Select the .pfx file from the file path and follow the import instructions.
  3. Once the import is finished your should see a new or updated certificate in the certificate list.
  4. Now you can use this certificate in your App Serices for example, for that go to your site resource in Azure

Open TLS/SSL settings in you App Service

  1. Click on Private Key Certificates (.-pfx) tab
  2. Import your certificate from Key Vault - follow the insturctions.
  3. After Import is finished go back to Bindings tab
  4. Click on Add TLS/SSL Binding
  5. Choose the imported certificate and follow the instrcutions
  6. After that your all setup and your site should have a valid certificate now.