Paying for certificates isn’t the done thing when you can get free certificates from Lets Encrypt. Free certificates from Lets Encrypt come at a different price and that is lifetime as the certificates are only ever valid for 90 days. If you’re still manually buying and installing certificates annually then you don’t want that four times a year so we automate the process end-to-end. This has been working perfectly since about 2018 for us, however, a recent alert about a certificate expiring made us sit up and look at this case of Azure App Service Lets Encrypt renewal failures and the resolution.
How is it automated?
The automation happens using an Extension installed within Azure App Service where we host our website. The extension, Azure Let’s Encrypt can be found at https://github.com/sjkp/letsencrypt-siteextension.
After a bit of tinkering to get it correctly installed, at the interval you set, a WebJob that runs against the App Service website will automatically retrieve a new certificate from Let’s Encrypt and apply it to your site. You have the option to define an alerting email address during the set-up process when things go wrong which in today’s case, proved important.
What was the problem?
What alerted us to a problem was the email notification to one of our monitoring mailboxes to report that the certificate was going to soon expire. We’ve never had this alert before because, for 3 years, this has worked without issue and never once failed to renew the certificate in time.
Looking at the logs for the WebJob in the App Service, we saw an error Unable to complete challenge with Lets Encrypt servers.
We took a look at the Issues log on the GitHub repository for the project behind the extension and it transpires that we were running version 1.0.4 of the extension and that other users reported that version 1.0.6, released just days ago, had no such issues.
Resolving the problem
Resolving the problem was a trivial task. First, we head into the Azure Portal at https://portal.azure.com and we navigate to our App Service instance where the extension is installed.
From the Extensions page, we can see that we have version 1.0.4 installed and that it is reporting that there is an update available. Drilling in to the extension itself, we can simply hit the Update button to update to the latest version of the Extension. Doing so took a matter of seconds and reported back 1.0.6 as the version okay.
From here, you can go to the WebJobs page to view the status of the Let’s Encrypt WebJob. This correctly shows as a Continuous job and the current status is Running which are both correct.
If you dig into the Extension, you have the option to view the log files. Here, we can see the previous failures that have occurred. In our test site, this now correctly showed as successfully completing and in the TLS/SSL Settings page for the App Service, we can see that new certificate has been issued and applied to the site.
We’ve now applied the same change to our production site and when the next instance of the WebJob runs, it will successfully issue and apply the new certificate as it has done for our test site already.
Do you want to get away from paying for certificates or automate any of your processes?
As this article hopefully illustrates, you can have nice things for free. The power of automation has saved us many hours over the 3 years that we’ve been using it and the solution turned out to be a simple one.
Simple isn’t always the name of the game though and your savings through automation could be many times more than ours.
Contact us at Arcible to find out how we could help you save time and money through automating routine business processes to streamline your business and give you and your staff more time to focus on what’s important.
If you interested in learning more about our services such as modernising existing services or maybe you want to explore moving to Microsoft Azure for your website or other applications, take a look at what we can offer.