Manually add-certificate works but how can I check that the auto renew is working?

[luu-at-pharm3r]

Hi There,
Thanks for your function app, it's saved us having to do all of this manually and paying the big corps.
Manually using the function app and /add-certificate works to setup the initial certs but now after 2+ months, how can I check that the auto renew is working as it's inside 30 day renewal period and my certificates are not auto renewing? What logs can I view or tests can I do to verify the issue?
Thanks,
Luu

[shibayan]

The automatic update process currently runs every Monday at midnight.

You can check the execution logs by selecting RenewCertificates from the Application Insights or Function list. Setting up a webhook is useful for notifying Slack and Teams of the success or failure of an update.

[luu-at-pharm3r]

Thanks for pointing to the error logs, I can see some in application insights. I have a 2 errors each function call Order, IssueCertificate, RenewCertificates_SubOrchestrator endpoints. The error for order is not very detailed can you give some insight to what to fix... "Message | Exception while executing function: Order NewOrder request did not specify any identifiers" where do I setup the identifiers and what are all the letsencrpt variables needed? Is the manual renewal (initial setup) different than the auto renewal configs?
Thanks,
Luu

[shibayan]

Thanks for the feedback. There seems to be a bug where the bindings are not updated for wildcards. This will be fixed as soon as possible.

[shibayan]

Did you manually bind a wildcard certificate to a non-wildcard hostname? Or are you using a wildcard certificate that is shared with another App Service?

[luu-at-pharm3r]

The hostname is api.mydomain.com and I binded the wildcard certificate *.mydomain.com to it yes. This wildcard certificate is used with other app services as well... so www. and staging. subdomains also use *.mydomain.com wildcard certificate. Thanks for covering different scenarios.

[shibayan]

Such a scenario of manually setting up certificate binding is not supported. This means that App Service Acmebot cannot share certificates with multiple App Services.

In such a scenario, you need to use the Key Vault version.
https://github.com/shibayan/keyvault-acmebot

[luu-at-pharm3r]

OK thanks... I'll look at implementing the keyvault one. Thanks for your support.