bicep AZ Gateway sslProfile deployment NOT enabling/working for httpListener

[HenkAJV]

Bicep version
Bicep CLI version 0.11.1 (030248d)

Describe the bug
Deploying Azure Gateway with sslProfile does NOT enable sslProfile on HTTP Listener.
GW resource definition used (Microsoft.Network/applicationGateways@2020-11-01)

I included more screen shots in the attached document.

To Reproduce
The following is the manual steps

1. Create GW with at least one listener
2. Create sslProfile on SSL Settings
3. Apply sslProfile on Listener
4. Export ARM script
5. Compile to BICEP
6. Deploy GW using BICEP script
7. Confirm/validate that the HTTTP Listener sslProfile is NOT ENABLED

Additional context
Please see attached document for screenshots
BICEP GW sslProfile BUG.docx

[alex-frankel]

Can you share the complete/relevant bicep code? Export Template can sometimes have issues where certain properties/resources may note be exported. Do you know which bicep properties are supposed to be set to enable this?

[HenkAJV]

Hi,

The following portion setup the sslProfile on the GW
(Manually: Navigate to GW->SSL settings->Add SSL Profile->Upload CA/Root Certificate)
Here are the two sections configuring sslProfiles as per Microsoft.Network/applicationGateways resource documentation

This configuration section is working, and create the sslProfile correctly
trustedClientCertificates: [
{
name:'ciwebCA'
properties: {
data:'-----BEGIN CERTIFICATE-----[REMOVE HERE, CERT PEM file]-----END CERTIFICATE-----'
}
}
]
sslProfiles: [
{
name:'EmployeeCerts'
properties: {
clientAuthConfiguration: {
verifyClientCertIssuerDN: true
}
trustedClientCertificates: [
{
id: '/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Network/applicationGateways/${gwName}/trustedClientCertificates/ciwebCA'
}
]
}
}
]

The following portion setup the sslProfile on the HTTP Listener
(Manually: Navigate to GW->Listeners->Pick Listener->Enable SSL Profile->Pick sslProfile from list as seen above configuration)
The expectation, looking at the Microsoft.Network/applicationGateways resource, shows no additional properties other than having sslProfile entry. I assume, once you have sslProfile configured, as shown below, then it would "Enable SSL Profile".

This section (sslProfile) appears to NOT WORK. It does not apply it to the listener. The portal shows it as not enabled.
httpListener: {
name: 'https-${dnsRecordName}'
properties: {
firewallPolicy: {
id: AGW_PWD_Waf.outputs.gwWafGlobalResourceID
}
frontendIPConfiguration: {
id: '/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Network/applicationGateways/${gwName}/frontendIPConfigurations/appGwPublicFrontendIp'
}
frontendPort: {
id: '/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Network/applicationGateways/${gwName}/frontendPorts/port_443'
}
protocol: 'Https'
sslCertificate: {
id: '/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Network/applicationGateways/${gwName}/sslCertificates/${dnsRecordName}-ciweb'
}
sslProfile: {
id: '/subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Network/applicationGateways/${gwName}/sslProfiles/EmployeeCerts'
}
hostName: '${dnsRecordName}.${gwHost}'
hostNames: []
requireServerNameIndication: true
}
}

I can share the full script. However, it's broken into multiple modules, and I will need to strip away any identifiers before I can upload it, and module scripts. The above configuration should hopefully suffice.

[HenkAJV]

Hi,
In preparing my script for possible upload, I found my issue in my script.
My apologies. I had the configuration in the module, but never pulled in the sslProfile into the main script.

We can close this discussion/issue.