Trying to attach SSL certificate on application gateway using azure terraform

Question

I am trying to pass PFX certificate from local machine to code azure terraform but when i am applying this method in terraform its showing one error certificate or password invalid. i have tested certificate and password both but its working fine. i have attache code and error details below Thanks-Onkar

resource "azurerm_application_gateway" "network" {
  name                = "my-application-gateway-12345"
  resource_group_name = azurerm_resource_group.rg.name
  location            = "West US"

  sku {
    name           = "Standard_Small"
    tier           = "Standard"
    capacity       = 2
  }

  gateway_ip_configuration {
      name         = "my-gateway-ip-configuration"
      subnet_id    = "${azurerm_virtual_network.vnet.id}/subnets/${azurerm_subnet.sub1.name}"
  }

  ssl_certificate {
    name     = "certificate"
    data     = "${base64encode(filemd5("test.pfx"))}"
    password = "*****"
  }

  frontend_port {
      name         = "feport"
      port         = 80
  }

  frontend_ip_configuration {
      name         = "feip"
      public_ip_address_id = "${azurerm_public_ip.pip.id}"
  }

  backend_address_pool {
      name = "beap"
  }

  backend_http_settings {
      name                  = "be-htst"
      cookie_based_affinity = "Disabled"
      port                  = 443
      protocol              = "Https"
     request_timeout        = 1
  }

  http_listener {
        name                                  = "httplstn"
        frontend_ip_configuration_name        = "feip"
        frontend_port_name                    = "feport"
        protocol                              = "https"
        ssl_certificate_name                  = "certificate"
  }

  request_routing_rule {
          name                       = "rqrt"
          rule_type                  = "Basic"
          http_listener_name         = "httplstn"
          backend_address_pool_name  = "beap"
          backend_http_settings_name = "be-htst"
  }
}

Update

after changes as per your instruction following error is occurred

i think you need to use `filebase64(path)` instead of `"${base64encode(filemd5("test.pfx"))}"` - filemd5 is calculating a hash of the file contents, but you need the whole content. — Alex AIT, Aug 13 '20 at 19:36
yes i have try this one but i foud folloing erro which is added below — terraform-ninja, Aug 14 '20 at 05:56

Nancy · Answer 1 · 2020-08-14T06:53:43.853

1

For the error message, you could use ssl_certificate block like this

ssl_certificate {
    name     = "certificate"
    data     = "${base64encode(file("test.pfx"))}"
    password = "*****"
  }

Here is an example in that question.

Update

For the error message, you could use the filebase64 function to obtain the Base64 encoded contents.

change it to

ssl_certificate {
    name     = "certificate"
    data     = "${filebase64("test.pfx")}"
    password = "xxxx"
  }

edited Aug 14 '20 at 06:53

answered Aug 14 '20 at 00:46

Nancy

26,865
3
18
34

i have try this method but i found following error. – terraform-ninja Aug 14 '20 at 05:57
change it to `data = "${filebase64("test.pfx"))"`, see my edit. – Nancy Aug 14 '20 at 06:41
If the error has been fixed by the reply, please accept this reply. – Nancy Aug 20 '20 at 05:24
@NancyXiong where should I put text.pfx file in my terraform project? Soulld I add it same directory where tf files are? – celcin Dec 17 '21 at 15:13

score 0 · Answer 2 · answered Mar 08 '21 at 09:10

Below is the module for application gateway:

locals {
  backend_address_pool_name      = format("appgwbeap-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  frontend_port_name             = format("appgwfeport-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  frontend_ip_configuration_name = format("appgwfeip-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  http_setting_name              = format("appgwhtst-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  listener_name                  = format("appgwhttplstnr-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  request_routing_rule_name      = format("appgwrqrt-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  redirect_configuration_name    = format("appgwrdrcfg-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
}

resource "azurerm_application_gateway" "appgw" {
  name                = format("appgw-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  resource_group_name = var.rg_name
  location            = var.location

  sku {
    name     = var.sku_name
    tier     = var.sku_tier
    capacity = var.sku_capacity
  }

  gateway_ip_configuration {
    name      = format("appgwipcfg-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
    subnet_id = var.subnet_id
  }

  frontend_port {
    name = "appgwfeport-app1-uatizweb-gw"
    port = "443"
  }


  frontend_port {
    name = "appgwfeport-app2-uatizweb-gw"
    port = "443"
  }

  ssl_certificate {
    name     = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    data     = filebase64("./certificates/web.app1.sso.gwwu.xxx.com.de-12Jan2021.pfx")
    password = "${var.app1_pfx_password}"
  }
  authentication_certificate {
    name = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    data = file("./certificates/web_app1_sso_gwwu_xxx_com_de-12Jan21.cer")
  }  

  ssl_certificate {
    name     = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    data     = filebase64("./certificates/selfsigned-app2-uat-01Mar21.pfx")
    password = "${var.app1_pfx_password}"
  }
  authentication_certificate {
    name = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    data = file("./certificates/selfsigned-app2-uat-01Mar21.cer")
  }  

  frontend_ip_configuration {
    name                 = "${local.frontend_ip_configuration_name}"
    subnet_id            = var.subnet_id
    private_ip_address   = var.frontend_private_ip
    private_ip_address_allocation = "Static"
  }

  backend_address_pool {
    name = "beap-path-app1-app"
    #fqdns     = var.fqdn_list
    ip_addresses = ["10.xxx.xxx.36"]
  }

  backend_address_pool {
    name = "beap-path-app2-app"
    #fqdns     = var.fqdn_list
    ip_addresses = ["10.xxx.xxx.37"]
  }

  backend_http_settings {
    name                  = "behs-path-app1-app"
    cookie_based_affinity = var.backend_cookie_based_affinity
    affinity_cookie_name  = "ApplicationGatewayAffinity"
    path                  = var.backend_path
    port                  = "443"
    #probe_name            = "probe-app1"
    protocol              = "Https"
    request_timeout       = var.backend_request_timeout
    authentication_certificate {
      name = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    }
  }

  backend_http_settings {
    name                  = "behs-path-app2-app"
    cookie_based_affinity = var.backend_cookie_based_affinity
    affinity_cookie_name  = "ApplicationGatewayAffinity"
    path                  = var.backend_path
    port                  = "443"
    #probe_name            = "probe-app2"
    protocol              = "Https"
    request_timeout       = var.backend_request_timeout
    authentication_certificate {
      name = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    }
  }

  http_listener {
    name                           = "appgwhttplsnr-app1-uatizweb-gw"
    frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
    frontend_port_name             = "appgwfeport-app1-uatizweb-gw"
    protocol                       = "Https"
    ssl_certificate_name           = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    require_sni                    = true
    host_name                      = "web.app1.sso.gwwu.xxx.com.de"
  }

  http_listener {
    name                           = "appgwhttplsnr-app2-uatizweb-gw"
    frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
    frontend_port_name             = "appgwfeport-app2-uatizweb-gw"
    ssl_certificate_name           = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    require_sni                    = true
    protocol                       = "Https"
    host_name                      = "web.app2.sso.gwwu.xxx.com.de"
  }

  request_routing_rule {
    name                       = "appgwrqrt-app2-uatizweb-gw"
    rule_type                  = var.backend_rule_type
    http_listener_name         = "appgwhttplsnr-app2-uatizweb-gw"
    backend_address_pool_name  = "beap-path-app2-app"
    backend_http_settings_name = "behs-path-app2-app"
  }

  request_routing_rule {
    name                       = "appgwrqrt-app1-uatizweb-gw"
    rule_type                  = var.backend_rule_type
    http_listener_name         = "appgwhttplsnr-app1-uatizweb-gw"
    backend_address_pool_name  = "beap-path-app1-app"
    backend_http_settings_name = "behs-path-app1-app"
  }
}

Below is the main.tf that calls the module:

module "app_gateway" {
  source                     = "../../../modules/appgateway"
  rg_name                    = var.rg_name
  agency                     = local.agency
  project_code               = local.project_code
  env                        = var.env
  zone                       = var.zone
  tier                       = "appgw"
  location                   = local.location
  vnet_name                  = var.vnet_name
  subnet_id                  = module.agw_subnet.subnet_id
  sku_name                   = var.appgw_sku_name
  sku_capacity               = var.appgw_sku_capacity
  frontend_private_ip        = var.appgw_frontend_ip
  frontend_port              = var.frontend_port
  frontend_protocol          = var.frontend_protocol
  app1_pfx_password          = "${var.app1_pfx_password}"
  backend_protocol           = var.backend_protocol
  backend_port               = var.backend_port
  backend_path               = "/"
  providers = {
    azurerm = azurerm.corpapps
  }
}

Trying to attach SSL certificate on application gateway using azure terraform

Update

2 Answers2

Update