Terraform部署Azure应用网关时重复SSL证书报错问题

我的KeyVault中存放着一张通配符SSL证书，需要为三个不同主机名（hostname1、hostname2、hostname3）创建Azure应用网关的HTTPS监听器。手动在Azure门户操作时可以复用该证书，但通过Terraform部署时触发了重复SSL证书的错误。

错误的Terraform代码（app_gateway.tf） #

http_listener {
    frontend_ip_configuration_name = "AppGWPublicFrontendIP"
    frontend_port_name             = "fp-443"
    host_names                     = ["${var.ENV}.hostname1.company.com"]
    name                           = "fl-hostname-https-443"
    protocol                       = "Https"
    ssl_certificate_name           = "star.company.com-cert"
  }
  http_listener {
    frontend_ip_configuration_name = "AppGWPublicFrontendIP"
    frontend_port_name             = "fp-443"
    host_names                     = ["${var.ENV}.hostname2.company.com"]
    name                           = "fl-hostname2-https-443"
    protocol                       = "Https"
    ssl_certificate_name           = "star.company.com-cert"
  }
  http_listener {
    frontend_ip_configuration_name = "AppGWPublicFrontendIP"
    frontend_port_name             = "fp-443"
    host_names                     = ["${var.ENV}.hostname3.company.com"]
    name                           = "fl-hostname3-https-443"
    protocol                       = "Https"
    ssl_certificate_name           = "star.company.com-cert"

ssl_certificate {
    name                = "star.company.com-cert"
    key_vault_secret_id = "https://keyvault.vault.azure.net/certificates/star-company-com/${var.certificate_secret_id}"
  }

错误信息 #

│ Error: updating Application Gateway: (Name "AppGateway_Name" / Resource Group "ResourceGroup_Name"): network.ApplicationGatewaysClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="ApplicationGatewayDuplicateSslCertificate" Message="Application Gateway /subscriptions/00000000-0000-0000-0000-0000000000/resourceGroups/ResourceGroup_Name/providers/Microsoft.Network/applicationGateways/AppGateway_Name cannot have same certificate used across two Ssl Certificate elements. Certificate for /subscriptions/00000000-0000-0000-0000-0000000000/resourceGroups/ResourceGroup_Name/providers/Microsoft.Network/applicationGateways/AppGateway_Name/sslCertificates/cert-***-env-hostname-cert and /subscriptions/00000000-0000-0000-0000-0000000000/resourceGroups/ResourceGroup_Name/providers/Microsoft.Network/applicationGateways/AppGateway_Name/sslCertificates/cert-***-env-hostname-cert are same." Details=[]

解决方案 #

1. 确保SSL证书仅定义一次 #

Azure应用网关要求每个SSL证书在网关内是唯一的资源。你需要在Terraform配置中只定义一次ssl_certificate块，所有HTTPS监听器统一引用这个唯一的证书名称。修正后的代码如下：

# 唯一的SSL证书定义，仅需配置一次
ssl_certificate {
    name                = "star.company.com-cert"
    key_vault_secret_id = "https://keyvault.vault.azure.net/certificates/star-company-com/${var.certificate_secret_id}"
}

# 三个HTTPS监听器，统一引用上述证书
http_listener {
    frontend_ip_configuration_name = "AppGWPublicFrontendIP"
    frontend_port_name             = "fp-443"
    host_names                     = ["${var.ENV}.hostname1.company.com"]
    name                           = "fl-hostname-https-443"
    protocol                       = "Https"
    ssl_certificate_name           = "star.company.com-cert"
}

http_listener {
    frontend_ip_configuration_name = "AppGWPublicFrontendIP"
    frontend_port_name             = "fp-443"
    host_names                     = ["${var.ENV}.hostname2.company.com"]
    name                           = "fl-hostname2-https-443"
    protocol                       = "Https"
    ssl_certificate_name           = "star.company.com-cert"
}

http_listener {
    frontend_ip_configuration_name = "AppGWPublicFrontendIP"
    frontend_port_name             = "fp-443"
    host_names                     = ["${var.ENV}.hostname3.company.com"]
    name                           = "fl-hostname3-https-443"
    protocol                       = "Https"
    ssl_certificate_name           = "star.company.com-cert"
}

2. 清理重复资源 #

如果上述修正后仍然报错，需要排查是否存在残留的重复证书资源：

• 执行terraform state list查找是否有重复的azurerm_application_gateway.xxx.ssl_certificate条目，若有则用terraform state rm <资源路径>移除多余条目。
• 登录Azure门户，检查应用网关的SSL证书列表，删除同名或内容重复的证书资源，再重新执行Terraform部署。

3. 验证KeyVault权限 #

确保应用网关的服务主体拥有KeyVault的证书读取权限：

• 在KeyVault的"访问策略"中，添加应用网关的身份（或对应的服务主体），授予"证书权限"中的"获取"权限，以及"密钥权限"中的"获取"权限。

内容的提问来源于stack exchange，提问作者Kalin-the-Builder