Creating an Azure certificate in Python

Question

I'm using Python to automate the creation of an App Service Cerficate for my Azure application (an AKS cluster). One of the REST calls I need to make is described here:

https://learn.microsoft.com/en-us/rest/api/appservice/appservicecertificateorders/createorupdate

This describes the call that's needed to create an App Service Cerficate Order, the result of which is then passed on to the REST call to create the App Service Certificate.

My problem is I can't figure out from the sparse documentation what is needed in the request body for this REST call. I've build a structure that looks like this:

request_body = {
    "location" : "eastus",
    "properties" : {
        "autoRenew" : true,
        "productType" : "StandardDomainValidatedSsl",
        "distinguishedName": "???",
        "csr": "???"
    }
}

I've been unable to figure out what is needed for these last two fields. The csr field is described as "Last CSR that was created for this order", with CSR referring to a Certificate Signing Request. The way this is worded implies there was a previous CSR but this is a new request and I have nothing previous to fill in here. If I try to leave distguishedName and csr both blank, the call complains. I've tried creating a CSR with openssl and setting the csr field to the value that's created but it doesn't seem to like it. The distinquishedName field I assume is supposed to something like

"CN=mydomain.com,C=US,ST=California,..."

but it always complains that whatever I provide is invalid.

I've done some searches and can find no examples of what is needed for this REST call. If anyone can point me to some sample code or additional documentation, I'd appreciate it. Thanks.

Peter

Take a look at this, it shows the AppServiceCertificateOrder property and you can find the csr in it. — Charles Xu
– Charles Xu, Commented Jan 20, 2019 at 4:07
This link provides the very same minimal information that's in the link I posted above. For the csr field it just says "Last CSR that was created for this order" and for the distinguishedName field the description is just "Certificate distinguished name". It doesn't include any examples beyond this. I know what a CSR looks like and I know what a dintinguished name looks like, but the attempts I make to call this REST operation always fail with complaints about these two fields. — user3280383
– user3280383, Commented Jan 20, 2019 at 20:25
You can use the List API to list the existing resources that you want to create and then maybe you would know how to configure it. — Charles Xu
– Charles Xu, Commented Jan 21, 2019 at 6:20

user3280383 · Accepted Answer · 2019-01-21 16:40:35Z

1

I finally determined that this combination works:

{
    "location": "global",
    "properties": {
        "productType": "StandardDomainValidatedSsl",
        "autoRenew": true,
        "distinguishedName":"CN=mysubdomain.mydomain.com"
    }
}

The csr field as it turns out is not needed; one is returned as a result of making this REST call. And this is just the first step in the certificate creation process. At this point the request is in a pending state and still needs to be validated.

answered Jan 21, 2019 at 16:40

user3280383

4653 gold badges10 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Ken W - Zero Networks · Accepted Answer · 2019-01-19 20:43:58Z

0

A CSR look something like:

answered Jan 19, 2019 at 20:43

Ken W - Zero Networks

3,8241 gold badge16 silver badges20 bronze badges

1 Comment

user3280383 Over a year ago

I know what a CSR looks like. As I mentioned in my post I created one with openssl and set the csr field to the string generated. The REST call still complained.

Collectives™ on Stack Overflow

Creating an Azure certificate in Python

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related