Skip to content

Getting Started

Jump to bottom
Tatsuro Shibamura edited this page Mar 14, 2026 · 19 revisions

Getting Started

This guide walks through the initial Acmebot deployment and the minimum configuration required to start issuing certificates.

1. Deploy Acmebot

Choose one of the supported deployment methods.

Azure Portal (ARM template)

Use this option when you want the fastest manual deployment path.

Azure (Public) Azure China Azure Government

Terraform module

Use this option when you already manage Azure resources as code with Terraform.

Published module:

Terraform Registry: shibayan/keyvault-acmebot/azurerm

Bicep module

A first-party Bicep module is not available yet. Track the current status here:

Publish the Bicep module in the Container Registry

2. Select the ACME CA

Acmebot can work with multiple ACME certificate authorities. Configure the CA endpoint you want to use.

  • Let's Encrypt
    • https://acme-v02.api.letsencrypt.org/directory
  • Buypass Go SSL
    • https://api.buypass.com/acme/directory
  • ZeroSSL
    • https://acme.zerossl.com/v2/DV90/
    • Requires EAB credentials
  • Google Trust Services
    • https://dv.acme-v02.api.pki.goog/directory
    • Requires EAB credentials
  • SSL.com
    • RSA: https://acme.ssl.com/sslcom-dv-rsa
    • ECDSA: https://acme.ssl.com/sslcom-dv-ecc
    • Requires EAB credentials
  • Entrust
    • Requires EAB credentials

Note

If your selected CA requires EAB, configure it before registering the ACME account.

3. Configure application settings

Update the Function App settings after deployment.

Note

Use __ as the hierarchical delimiter in Function App setting names so the same keys work on Flex Consumption and other Linux-based plans.

Setting Required Description
Acmebot__VaultBaseUrl When using an existing Key Vault Base URL of the Key Vault to store and manage certificates
Acmebot__Webhook No Webhook destination for success and failure notifications
Acmebot__PreferredChain No Preferred certificate chain, when the CA offers multiple chains
Acmebot__RenewBeforeExpiry No Number of days before expiry when renewal starts. Default: 30
Acmebot__UseSystemNameServer No Set to true to use the App Service resolver instead of an external DNS resolver
Acmebot__DefaultSigner No Default ACME signing algorithm. Primarily useful for Entrust
Acmebot__ManagedIdentityClientId No Client ID for a user-assigned managed identity

Acmebot also creates and maintains the following settings automatically:

  • Acmebot__Endpoint
    • ACME directory endpoint used for issuance
  • Acmebot__Contacts
    • Contact email address used during ACME account registration

Where possible, store provider secrets by using Key Vault references instead of plain-text Function App settings.

4. Configure your DNS provider

Acmebot uses DNS-01 validation, so you must configure one supported DNS provider.

Supported providers:

  • Amazon Route 53
  • Azure DNS
  • Cloudflare
  • DNS Made Easy
  • Gandi LiveDNS
  • GoDaddy
  • Google Cloud DNS
  • TransIP DNS
  • Custom DNS provider

See the provider-specific settings here:

DNS Providers

5. Enable App Service Authentication

Enable authentication on the deployed Function App before using the dashboard or protected API endpoints.

Microsoft Entra ID is the recommended identity provider for interactive access and bearer-token based API access.

  1. Open the Function App in Azure Portal.
  2. Open the Authentication menu.
  3. Add Microsoft as the identity provider.
  4. Keep the default generated settings unless your environment requires a custom configuration.
  5. Set the application to Require authentication.

Add an Identity provider

App Service Authentication settings

Note

In sovereign clouds, the Express experience may not be available. Use the advanced setup instead:

6. Grant access to an existing Key Vault

If you are using an existing Key Vault, grant the deployed application permission to manage certificates in that vault. Use either an access policy or the equivalent RBAC role, depending on the vault permission model.

Key Vault access policy

7. Open the dashboard

Browse to https://YOUR-FUNCTIONS.azurewebsites.net/dashboard to view and manage certificates.

From the dashboard you can:

  • Issue a new certificate
  • Renew an existing certificate
  • Revoke a certificate
  • Review certificates currently managed by Acmebot

Dashboard

The dashboard feature is currently in preview. Feedback is welcome in issue #341.

8. Verify the deployment

Before issuing the first certificate, confirm the following:

  • You can sign in to the dashboard successfully.
  • The target Key Vault is reachable and writable by the deployed application.
  • DNS provider settings are configured for the zone you want to validate.

Next steps

Clone this wiki locally