Bulk/mass change SSL certificates on Azure app services (web apps) - azure

Question

I've a wildcard SSL that has expired, and I have the new cert (different authority) uploaded to Azure already..
..but I'd like to know if there's a way to bulk change all the sites using the old cert, over to the new cert. On normal IIS when you make a change for any one of your sites on the old cert, to the new cert, it asks you if you want to update other bindings that are using the old cert so that they also use the new cert. I've around 30 sites I need to move to the new cert and it's going to be quite a drag one by one
Is there an equivalent functionality on Azure? Powershell is acceptable if the portal.azure.com won't do it..

Answer 1

I've been using Azure CLI in Powershell for this. First build a CSV file or array with the values. It will need to contain:
- Web App Name
$Thumbprint
Then iterate through
$Thumbprint = "12bnhgikjbkj13kjbblahblah"
$WebApps = #("WebApp1","WebApp2","WebApp3") #OR
Foreach ($WebApp in $WebApps) {
az webapp config ssl bind --certificate-thumbprint $Thumbprint --ssl-type SNI --resource-group ResourceGroupName --name "$WebApp"
}
You can also do it with New-AzureRmWebAppSSLBinding from here. Also a guide here on how to do it.

Answer 2

I used the following code in Azure Cloud Shell to enumerate how many apps were using the old thumbprint and updated them to the new one. I found this easier than writing down each of the app service names.
You'll need to make sure you import your new certificate first.
az account set --subscription "My Application"
$webapp_ids=(az webapp list --query "[?hostNameSslStates.[thumbprint=='OLD_THUMBPRINT']].id" --output tsv)
az webapp config ssl bind --certificate-thumbprint "NEW_THUMBPRINT" --ssl-type SNI --ids $webapp_ids