Skip to content

Azure DNS (dns_azure)

DNS-01 proves that you own the name by writing a TXT record _acme-challenge.<name> in your public DNS zone through Azure DNS's API. No inbound port is needed. See TLS certificates to decide whether you need it.

Variables

Variable Kind Notes
AZUREDNS_CLIENTSECRET secret Typed on the server or read from the credentials file. Never on a command line.
AZUREDNS_SUBSCRIPTIONID setting required. Passed with --dns-setting AZUREDNS_SUBSCRIPTIONID=....
AZUREDNS_TENANTID setting required. Passed with --dns-setting AZUREDNS_TENANTID=....
AZUREDNS_APPID setting required. Passed with --dns-setting AZUREDNS_APPID=....

The names are the exact acme.sh ones.

Least privilege

Dedicated app registration (service principal) with the DNS Zone Contributor role assigned on this DNS zone only. Short client secret lifetime.

Always use a token dedicated to one host, limited to the zone, with an expiry when Azure DNS supports it. If you cannot restrict it enough, use a challenge alias so the token only needs rights on a small dedicated zone.

Install with scripts/install.sh

  1. Put the secret values in a file only root can read (one VARIABLE=value per line):

    ( umask 077; cat > /root/tenantry-dns.env <<'EOF'
AZUREDNS_CLIENTSECRET=<value>
EOF
)

  2. Install. The guided mode asks for the same things. This is the equivalent command, for Tenantry on the same server as Teleport:

    sudo scripts/install.sh --name acme --public-url https://tenantry.acme.ch:9443 \
  --teleport-local auto \
  --tls acme-dns --dns-provider dns_azure \
  --dns-setting AZUREDNS_SUBSCRIPTIONID=<subscription-id> \
  --dns-setting AZUREDNS_TENANTID=<tenant-id> \
  --dns-setting AZUREDNS_APPID=<app-id> \
  --dns-credentials-file /root/tenantry-dns.env \
  --acme-email ops@acme.ch --https-port 9443

    --https-port 9443 is used because Teleport already owns port 443 on the same server. On a server without Teleport, leave it out and use --public-url https://tenantry.acme.ch.

  3. Delete the credentials file (shred -u /root/tenantry-dns.env). The installer keeps its own copy in <dir>/secrets/acme-dns.env (mode 0600) for the renewals.

To replace the token later, delete <dir>/secrets/acme-dns.env and run install.sh again.

The Teleport master bundle (bootstrap.sh) and the Steward bundles (install.sh) ask for the same variables, or read --dns-credentials-file FILE.