Add https to Service Fabric Web Api - azure

Question

I've created a Service Fabric Cluster with the Azure portal. It's secured by a wildcard SSL certificate from a CA. The certificate is stored in the keyvault.
In the cluster I have several web api services. I would like to add https endpoints to them.
I've followed this guide to update the configuraton, Added https endpoint to ServiceManifest.xml in Nimles.UserManagement.Api.Authorized
<Endpoint Protocol="https" Name="ServiceEndpointHttps" Type="Input" Port="9021" />
Added binding to ApplicationManifest.xml
<ServiceManifestRef ServiceManifestName="Nimles.UserManagement.Api.AuthorizedPkg" ServiceManifestVersion="1.0.0" />
<Policies>
<EndpointBindingPolicy EndpointRef="ServiceEndpointHttps" CertificateRef="NimlesComCert" />
</Policies>
Added certificate
<Certificates>
<EndpointCertificate X509FindValue="*****" Name="NimlesComCert" />
</Certificates>
But I can't find information on how to add the certificate to the VM since I've used the portal to create the cluster, and all guides just referers to ARM templates.
I don't mind if I need to use ARM if this is not possible from the portal, but I don't want to recreate the cluster, in that case just use ARM with my current cluster.

Answer 1

The basic steps to add SSL to your Web Api in Service Fabric are:
Add certificate to KeyVault
Install it on VM Scale Set VMs
Add certificate to ServiceManifest and ApplicationManifest (or add it to your services some other way, let's go with manifest here)
Based on you description above you likely already have all of these steps covered. When you secure a cluster with a certificate, that certificate is installed on each VM in the cluster. It should just be a matter of referencing it in your manifest. Look at step 2 below for updating the VMs using ARM if you need to add another certificate to the cluster (if you are running multiple applications secured with different certificates).
Just for reference, I am adding all the required steps below.
Add certificate to KeyVault
You have already done this, but just for reference
I recommend using ServiceFabricRPHelpers to help adding the certificate to the KeyVault. Something along these lines from PowerShell
Invoke-AddCertToKeyVault
-SubscriptionId $subscriptionId
-ResourceGroupName $vaultResourceGroupName
-Location $vaultLocation
-VaultName $vaultName
-CertificateName $clusterCertName
-Password $clusterCertPw
-UseExistingCertificate
-ExistingPfxFilePath $certFilePath
Install certificate on VMSS
Since you have secured your cluster with a cert, your VMs already have the vault certificate installed, but again, just for reference
You can do this with either PS cmdlets, or by updating the ARM template. The PS cmdlet could look like this:
$certConfig = New-AzureRmVmssVaultCertificateConfig
-CertificateUrl $certificateUrl
-CertificateStore $certStore
# Add the certificate as a new secret on each VM in the scaleset
$vmss = (Get-AzureRmVmss | Where-Object{$_.name -eq $vmssName})[0]
$vmss.VirtualMachineProfile.OsProfile.Secrets[0].VaultCertificates.Add($certConfig)
# Trigger an update the VMs in the scaleset
Update-AzureRmVmss -ResourceGroupName $ResourceGroup -Name $VmssName -VirtualMachineScaleSet $Vmss
And the ARM version would look like this
"osProfile": {
"adminPassword": "[parameters('adminPassword')]",
"adminUsername": "[variables('adminUsername')]",
"computernamePrefix": "[variables('vmNodeType0ComputerName')]",
"secrets": [
{
"sourceVault": {
"id": "[parameters('sourceVaultValue')]"
},
"vaultCertificates": [
{
"certificateStore": "[variables('certificateStoreValue')]",
"certificateUrl": "[parameters('certificateUrlValue')]"
}
]
}
]
},
For the ARM template version of this, you can update the already deployed cluster by either downloading the automatically generated script from Azure Portal, or by downloading the actual template you used when deploying the first time (even if you deployed by using a wizard in the portal it actualy creates a template behind the scenes for you and it is that one that is deployed when you click OK in the last step).
Find the Resource Group with your cluster in the portal.
The Automation Script renders a new template for you based on what the Resource Group contains at this point, it is an accumulation of all your changes up to this point of the resources in the group. Click download and you will get a .zip with both the template file and parameters.
You can now redeploy it using either PowerShell like this:
New-AzureRmResourceGroupDeployment
-Name "Update_admin_cert"
-TemplateFile .\template.json
-ResourceGroupName $resourceGroupName
-Mode Incremental
Note the Mode Incremental option, it simply patches whatever is already in your resource group with any new or overlapping definitions in the template your are deploying, so it is (in general) safe to run it on an existing resource group if you only want to change or add some detail for a resource.
Adding certificate to ApplicationManifest
Adding the certificate to your service is a matter of updating the manifest used for deploying the application/services. This documentation article outlines what you need. In short, add a EndpointBindingPolicy to the ServiceManifestImport in ApplicationManifest.xml and a certificate in the Certificates tag that references the thumbprint for your certificate:
<ServiceManifestImport>
<ServiceManifestRef ServiceManifestName="Stateful1Pkg" ServiceManifestVersion="1.0.0" />
<ConfigOverrides />
<Policies>
<EndpointBindingPolicy CertificateRef="TestCert1" EndpointRef="ServiceEndpoint3"/>
</Policies>
</ServiceManifestImport>
<Certificates>
<EndpointCertificate Name="TestCert1" X509FindValue="ABCDEF27174012740129FADBC232348324" X509StoreName="MY" />
</Certificates>

Answer 2

You can use the portal to generate an ARM template for an existing resource group. Click to the 'automation script' menu item. Then you click 'download'.
Then you can redeploy the resource of type 'Microsoft.Compute/virtualMachineScaleSets', with the certificate info in node 'virtualMachineProfile'. (delete the rest, remove the dependencies)
Note that you'll have to provide any parameter values, as they are not filled out automatically.
(I'd recommend using an ARM template to create the cluster to begin with though.)