Dashboard
The dashboard is the primary interface for Acmebot. The Function App serves the dashboard, and the dashboard calls the same-origin /api/* endpoints.
Access
The dashboard requires authenticated requests, so configure App Service Authentication on the Function App before using it. Once authentication is enabled, open the Function App URL in a browser. If the dashboard returns 401 Unauthorized, check the authentication configuration first.
Current Configuration
Select Configuration in the header to view the ACME directory, contact email, preferred chain and profile, general settings, and settings for each configured DNS provider. Credentials appear only as Configured or Not configured; their values are never returned to the browser. URL user information, query strings, and fragments are omitted.
The panel is read-only and available to authenticated users. Opening or refreshing it does not register an ACME account, contact DNS providers, or change settings. Configured indicates a nonblank credential value, not successful authentication. Unset managed identity client IDs use the default identity: providers inherit the app-wide identity, which uses the system-assigned identity when its client ID is also unset.
Change settings through the Function App configuration. The panel shows the settings currently loaded by Acmebot; Refresh reloads this view and does not apply pending Azure configuration changes.
ACME Account Information
Select Account in the header to view the directory URL and CAA identities with copy buttons. The panel also shows DNS-PERSIST-01 issuer domain names, account hash prefix, and whether valid pre-provisioning metadata is available. CAA identities are separate from persistent-validation issuer names. Missing or malformed pre-provisioning inputs show Not available; an older API that omits the discovery object shows Unknown.
The first successful load registers an ACME account if one does not exist yet. Configure the contact email and any required external account binding credentials before opening the panel. It does not create a certificate order or modify DNS records.
These values describe the configured CA and its advertised metadata. The account URL is managed internally and is not displayed. Acmebot does not generate _validation-persist TXT values or support issuance through DNS-PERSIST-01 yet. See the DNS-PERSIST-01 operating model.
Certificate List
The dashboard lists certificates from the configured Key Vault and marks each one by category:
- Managed by Acmebot and issued for the current ACME endpoint.
- Managed by Acmebot but issued for another ACME endpoint.
- Not managed by Acmebot.
Only enabled certificates with Acmebot metadata for the current endpoint are selected for scheduled renewal. Renewal status is tracked per managed certificate, including its current state, next check time, and last check time.
DNS Zone List
The dashboard lists zones from all configured DNS providers. A provider that fails to list zones is dropped from the result, so check Application Insights if an expected provider is missing.
Load the zone list before issuing your first certificate. This confirms that DNS credentials, managed identity permissions, and network access are configured correctly.
Issue a Certificate
- Select a DNS provider and zone.
- Enter the record name under that zone.
- Review the resulting DNS name.
- Choose key options.
- Set advanced options if required.
- Submit the request and wait for the operation overlay to complete.
Leave the record name empty for the zone apex, or use * as the leftmost label for a wildcard certificate.
Key Options
| Key type | Supported values |
|---|---|
| RSA | 2048, 3072, 4096 |
| EC | P-256, P-384, P-521, P-256K |
The default is RSA 2048. Use EC only when the downstream service supports the selected curve.
Advanced Options
Certificate Name
Certificate names can contain letters, numbers, and hyphens. If omitted in the dashboard, the dashboard derives a name from the first DNS name by replacing * with wildcard and dots with hyphens before sending the request.
To switch a certificate that Acmebot does not manage, such as one imported from another certificate authority, issue a certificate with the same name. The dashboard asks for confirmation before replacing it; the ACME certificate is added as a new version of the existing Key Vault certificate.
Delegated DNS-01
Use the delegated DNS-01 issue mode when the DNS provider selected in Acmebot manages only the validation zone, not the certificate's public DNS zone. Enter full DNS names for the certificate, select the DNS alias zone that Acmebot can update, and create the displayed CNAME records in the authoritative DNS provider before submitting.
DNS Alias
Set DNS Alias when the ACME challenge should be created under another domain. Acmebot then writes TXT records at _acme-challenge.<dnsAlias> with the selected DNS provider. The alias value must not include the _acme-challenge prefix. In delegated DNS-01 mode, the dashboard generates a unique alias record in the selected alias zone and shows the CNAME records to create in the certificate domain's DNS provider.
ACME Profile
Set ACME Profile when the certificate should use a specific profile advertised by the configured ACME directory. If omitted, Acmebot uses the deployment-level Acmebot__PreferredProfile setting when configured. The selected profile is saved with the certificate metadata and reused during renewal.
Tags
Custom tags are written to the Key Vault certificate. The Acmebot tag is reserved for internal metadata and cannot be set manually.
Renew a Certificate
Manual renewal reuses the existing Key Vault certificate policy and starts a new issuance orchestration. Use it to rotate a certificate before its scheduled renewal window. Renew is available only for certificates managed by Acmebot.
The daily RenewCertificates timer ensures a renewal scheduler is running for each eligible certificate. Each scheduler wakes independently at its next check time. Certificates with ACME Renewal Information (ARI) renew at a selected time within the CA's suggested window, with earlier ARI refreshes based on Retry-After; certificates without renewal information use the configured fallback threshold. See Operations for the scheduling details.
Revoke a Certificate
Revocation sends the certificate to the configured ACME certificate authority's revoke endpoint, then automatically disables the current Key Vault certificate version. Only certificates that Acmebot issued through the configured ACME endpoint can be revoked. The certificate remains in Key Vault, and disabled certificates are excluded from automatic renewal. After revocation, decide whether to delete or replace the certificate according to your operational policy.
Operation Status
Issue and renew operations return an operation URL, which the dashboard polls until the operation completes or fails. If an operation fails:
- Read the displayed problem message.
- Check Application Insights for the orchestration instance ID.
- Verify DNS records and provider permissions.
- Retry after fixing the underlying issue.