ARM模板循环依赖问题：Web应用自定义域名、自管理证书与绑定

核心原因 #

你的循环依赖源于：hostnameBindings需要先创建自定义域名（作为证书的依赖），但又要在自身属性中引用证书的指纹，导致hostnameBindings ↔ certificates互相依赖，打破了ARM的部署顺序逻辑。

解决方案：拆分部署阶段 #

ARM模板不支持单个属性依赖资源，但可以通过拆分部署为两个阶段打破循环：

1. 第一阶段：仅创建不带SSL配置的hostnameBindings（完成自定义域名绑定）
2. 第二阶段：基于已绑定的域名创建自管理证书，再更新hostnameBindings添加SSL属性

方法1：分两个独立模板部署 #

模板1：创建基础域名绑定

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "variables": {
    "siteName": "<你的Web应用名称>",
    "domainName": "<你的自定义域名>"
  },
  "resources": [
    {
      "type": "Microsoft.Web/sites/hostnameBindings",
      "apiVersion": "2023-01-01",
      "name": "[concat(variables('siteName'), '/', variables('domainName'))]",
      "properties": {
        "customHostNameDnsRecordType": "CName",
        "hostNameType": "Verified"
      }
    }
  ]
}

模板2：创建证书并更新SSL绑定

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "variables": {
    "siteName": "<你的Web应用名称>",
    "domainName": "<你的自定义域名>",
    "enableSSL": true,
    "certPassword": "<证书密码>",
    "certPfxBlob": "<PFX文件的base64编码内容>"
  },
  "resources": [
    {
      "type": "Microsoft.Web/certificates",
      "apiVersion": "2023-01-01",
      "name": "[variables('domainName')]",
      "properties": {
        "hostNames": [variables('domainName')],
        "password": "[variables('certPassword')]",
        "pfxBlob": "[variables('certPfxBlob')]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Web/sites/hostnameBindings', variables('siteName'), variables('domainName'))]"
      ]
    },
    {
      "type": "Microsoft.Web/sites/hostnameBindings",
      "apiVersion": "2023-01-01",
      "name": "[concat(variables('siteName'), '/', variables('domainName'))]",
      "properties": {
        "sslState": "[if(variables('enableSSL'), 'SniEnabled', json('null'))]",
        "thumbprint": "[if(variables('enableSSL'), reference(resourceId('Microsoft.Web/certificates', variables('domainName'))).Thumbprint, json('null'))]",
        "customHostNameDnsRecordType": "CName",
        "hostNameType": "Verified"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Web/certificates', variables('domainName'))]"
      ]
    }
  ]
}

部署时先执行模板1，再执行模板2即可。

方法2：在单个主模板中用嵌套部署实现分阶段 #

如果希望用一个模板完成所有操作，可以通过嵌套部署将两个阶段整合：

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "variables": {
    "siteName": "<你的Web应用名称>",
    "domainName": "<你的自定义域名>",
    "enableSSL": true,
    "certPassword": "<证书密码>",
    "certPfxBlob": "<PFX文件的base64编码内容>"
  },
  "resources": [
    // 第一阶段：创建基础域名绑定
    {
      "type": "Microsoft.Web/sites/hostnameBindings",
      "apiVersion": "2023-01-01",
      "name": "[concat(variables('siteName'), '/', variables('domainName'))]",
      "properties": {
        "customHostNameDnsRecordType": "CName",
        "hostNameType": "Verified"
      }
    },
    // 第二阶段：嵌套部署证书与SSL绑定更新
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2023-07-01",
      "name": "deploySSLConfiguration",
      "dependsOn": [
        "[resourceId('Microsoft.Web/sites/hostnameBindings', variables('siteName'), variables('domainName'))]"
      ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "variables": {
            "siteName": "[variables('siteName')]",
            "domainName": "[variables('domainName')]",
            "enableSSL": "[variables('enableSSL')]",
            "certPassword": "[variables('certPassword')]",
            "certPfxBlob": "[variables('certPfxBlob')]"
          },
          "resources": [
            {
              "type": "Microsoft.Web/certificates",
              "apiVersion": "2023-01-01",
              "name": "[variables('domainName')]",
              "properties": {
                "hostNames": [variables('domainName')],
                "password": "[variables('certPassword')]",
                "pfxBlob": "[variables('certPfxBlob')]"
              }
            },
            {
              "type": "Microsoft.Web/sites/hostnameBindings",
              "apiVersion": "2023-01-01",
              "name": "[concat(variables('siteName'), '/', variables('domainName'))]",
              "properties": {
                "sslState": "[if(variables('enableSSL'), 'SniEnabled', json('null'))]",
                "thumbprint": "[if(variables('enableSSL'), reference(resourceId('Microsoft.Web/certificates', variables('domainName'))).Thumbprint, json('null'))]",
                "customHostNameDnsRecordType": "CName",
                "hostNameType": "Verified"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/certificates', variables('domainName'))]"
              ]
            }
          ]
        }
      }
    }
  ]
}

注意事项 #

• 更新hostnameBindings时必须包含所有必要属性（如customHostNameDnsRecordType、hostNameType），避免增量部署时覆盖原有配置。
• 确保自定义域名已完成DNS验证，否则证书创建会失败。

内容的提问来源于stack exchange，提问作者Gringo404