Connector in Azure

Deploy certforge-connector as an Azure Container Instance (ACI) inside your VNet so it can reach F5 BIG-IP, Ribbon SBCs, and other devices on private management addresses. No inbound firewall rules are required — the connector makes outbound calls only.

Prerequisites

Azure subscription with Contributor rights on the resource group
An existing VNet that routes to the device management subnet
NSG rule allowing TCP from the ACI subnet to the device management port (443 by default)
A CertForge account with admin or operator role

Step 1 — Authenticate

The connector supports two authentication methods. mTLS is recommended — it connects directly to the CertForge agent endpoint on port 8443, bypassing Cloudflare.

Option A — mTLS enrollment (recommended)

Run enrollment locally (not inside the container) on any machine with certforge-connector installed. In CertForge: Integrations → Connector Agents → + Enroll Agent → Connector — give it a label (e.g. azure-northcentralus) and copy the one-time token.

certforge-connector enroll \
  --token  <one-time-token>        \
  --url    https://app.certgov.app \
  --label  azure-northcentralus    \
  --out    ./azure-creds

This writes three files to ./azure-creds/:

File	Contents
`client.crt`	Client certificate
`client.key`	Client private key
`server.crt`	Pinned CertForge agent CA

Store the credentials in an Azure File Share so the container can mount them:

# Create a storage account and file share for the connector creds
az storage account create \
  --name          cfconnectorcreds \
  --resource-group YOUR_RG \
  --location      YOUR_REGION \
  --sku           Standard_LRS

STORAGE_KEY=$(az storage account keys list \
  --account-name cfconnectorcreds \
  --resource-group YOUR_RG \
  --query "[0].value" -o tsv)

az storage share create \
  --name           connector-creds \
  --account-name   cfconnectorcreds \
  --account-key    $STORAGE_KEY

az storage file upload \
  --share-name connector-creds \
  --account-name cfconnectorcreds \
  --account-key $STORAGE_KEY \
  --source ./azure-creds/client.crt --path client.crt

az storage file upload \
  --share-name connector-creds \
  --account-name cfconnectorcreds \
  --account-key $STORAGE_KEY \
  --source ./azure-creds/client.key --path client.key

az storage file upload \
  --share-name connector-creds \
  --account-name cfconnectorcreds \
  --account-key $STORAGE_KEY \
  --source ./azure-creds/server.crt --path server.crt

The container config in the steps below will mount this share at /etc/certforge-connector/creds.

Option B — API key (legacy)

In CertForge: Settings → API Keys → New Key (connector scope). Copy the key — shown once only. You will pass it as a secure environment variable in the steps below.

Step 2 — Prepare the subnet

ACI requires a subnet delegated exclusively to Microsoft.ContainerInstance/containerGroups. A dedicated subnet is cleaner than sharing one with other resources. In the Azure Portal go to Virtual networks → YOUR_VNET → Subnets → + Subnet:

Field	Value
Name	`certforge-connector` (or any descriptive name)
Size	`/29` — smallest valid; ACI only needs one IP
Subnet delegation	`Microsoft.ContainerInstance/containerGroups`

A delegated subnet cannot contain other resource types (VMs, load balancers). Create a dedicated one.

Step 3 — Create the Container Instance

In the Azure Portal go to Container instances → + Create. Basics tab

Field	Value
Container name	`certforge-connector`
Region	Same region as your VNet
Image source	Other registry
Image	`ghcr.io/certforge-llc/certforge-connector:latest`
OS type	Linux
Size	1 vCPU, 1 GiB memory

Networking tab

Field	Value
Networking type	Private — enables VNet integration, private IP only
Virtual network	Your VNet
Subnet	The subnet from step 2
Ports	Delete any pre-filled ports — no inbound ports needed

Advanced tab — mTLS auth (Option A): Add environment variables:

Name	Value	Secure
`CERTFORGE_URL`	`https://app.certgov.app`	No
`MTLS_HOST`	`usagent.certgov.app`	No
`MTLS_PORT`	`8443`	No
`MTLS_CERT`	`/etc/certforge-connector/creds/client.crt`	No
`MTLS_KEY`	`/etc/certforge-connector/creds/client.key`	No
`MTLS_CA`	`/etc/certforge-connector/creds/server.crt`	No

Add a volume mount for the Azure File Share:

Field	Value
Volume name	`creds`
Mount path	`/etc/certforge-connector/creds`
Volume type	Azure File Share
Storage account	`cfconnectorcreds`
File share	`connector-creds`

Advanced tab — API key auth (Option B, legacy): Add two environment variables:

Name	Value	Secure
`CERTFORGE_URL`	`https://app.certgov.app`	No
`CERTFORGE_API_KEY`	`ct_YOUR_KEY`	Yes

Set Restart policy to Always. Click Review + create, then Create. Deployment takes about 60–90 seconds.

Step 4 — Verify the connector is live

Once running, check the logs:

az container logs \
  --resource-group YOUR_RG \
  --name certforge-connector \
  --follow

mTLS auth — expected output:

[connector] starting v0.3.x - mTLS → usagent.certgov.app:8443, polling every 30s

API key auth — expected output:

[connector] starting v0.3.x - polling https://app.certgov.app every 30s

In CertForge, go to Integrations → Connector Agents — the agent should show a green Last seen timestamp within a minute.

If the container keeps restarting (ExitCode 1), check the logs for an auth error. The most common cause is a typo in the API key or wrong certificate path. Delete and recreate the container with the corrected values — environment variables on a running ACI instance cannot be edited in place.

Step 5 — Add the device in CertForge

With the connector inside the VNet, register the device using its private management IP:

Go to Integrations → Network Devices → Add Device
Set Type to f5, ribbon, or the appropriate driver
Enter the private management IP and port
Enter credentials and configure TLS settings
Click Query Cert to confirm connectivity

Azure CLI equivalent

mTLS auth (Option A):

# Delegate the subnet
az network vnet subnet update \
  --resource-group YOUR_RG \
  --vnet-name      YOUR_VNET \
  --name           YOUR_SUBNET \
  --delegations    Microsoft.ContainerInstance/containerGroups

# Deploy with mTLS creds mounted from Azure File Share
az container create \
  --resource-group  YOUR_RG \
  --name            certforge-connector \
  --location        YOUR_REGION \
  --image           ghcr.io/certforge-llc/certforge-connector:latest \
  --vnet            YOUR_VNET \
  --subnet          YOUR_SUBNET \
  --os-type         Linux \
  --cpu 1 --memory 1 \
  --restart-policy  Always \
  --environment-variables \
      CERTFORGE_URL=https://app.certgov.app \
      MTLS_HOST=usagent.certgov.app \
      MTLS_PORT=8443 \
      MTLS_CERT=/etc/certforge-connector/creds/client.crt \
      MTLS_KEY=/etc/certforge-connector/creds/client.key \
      MTLS_CA=/etc/certforge-connector/creds/server.crt \
  --azure-file-volume-share-name  connector-creds \
  --azure-file-volume-account-name cfconnectorcreds \
  --azure-file-volume-account-key  $STORAGE_KEY \
  --azure-file-volume-mount-path  /etc/certforge-connector/creds

API key auth (Option B, legacy):

az container create \
  --resource-group YOUR_RG \
  --name           certforge-connector \
  --location       YOUR_REGION \
  --image          ghcr.io/certforge-llc/certforge-connector:latest \
  --vnet           YOUR_VNET \
  --subnet         YOUR_SUBNET \
  --os-type        Linux \
  --cpu 1 --memory 1 \
  --restart-policy Always \
  --environment-variables \
      CERTFORGE_URL=https://app.certgov.app \
  --secure-environment-variables \
      CERTFORGE_API_KEY=ct_YOUR_KEY

To update the container after a new release, delete and recreate it — ACI does not re-pull :latest on a running instance:

az container delete --resource-group YOUR_RG --name certforge-connector --yes
# then run the create command above

Rotating mTLS credentials

When the mTLS client certificate nears expiry, re-enroll locally and upload the new files to the Azure File Share:

certforge-connector enroll \
  --token  <new-one-time-token>    \
  --url    https://app.certgov.app \
  --label  azure-northcentralus    \
  --out    ./azure-creds

# Re-upload each file
for f in client.crt client.key server.crt; do
  az storage file upload \
    --share-name connector-creds \
    --account-name cfconnectorcreds \
    --account-key $STORAGE_KEY \
    --source ./azure-creds/$f --path $f
done

# Restart the container to pick up new creds
az container restart --resource-group YOUR_RG --name certforge-connector

Egress requirements

Destination	Port	When
`app.certgov.app`	443	Always (API key auth, enrollment)
`usagent.certgov.app`	8443	mTLS auth — direct agent endpoint
Device management IPs	443 (default)	Always — routes via VNet to private VLAN

Environment variable reference

Variable	Required	Description
`CERTFORGE_URL`	Yes	CertForge instance URL
`CERTFORGE_API_KEY`	Option B	API key from Connector Agents. Starts with `ct_`. Mark as Secure.
`MTLS_HOST`	Option A	Direct agent hostname (e.g. `usagent.certgov.app`)
`MTLS_PORT`	Option A	mTLS port — `8443` prod, `8444` preview/dev
`MTLS_CERT`	Option A	Path to client certificate file
`MTLS_KEY`	Option A	Path to client private key file
`MTLS_CA`	Option A	Path to pinned server CA file
`CERTFORGE_POLL`	No	Poll interval. Default: `30s`. Accepts Go duration strings (`1m`, `2m`).

​Prerequisites

​Step 1 — Authenticate

​Option A — mTLS enrollment (recommended)

​Option B — API key (legacy)

​Step 2 — Prepare the subnet

​Step 3 — Create the Container Instance

​Step 4 — Verify the connector is live

​Step 5 — Add the device in CertForge

​Azure CLI equivalent

​Rotating mTLS credentials

​Egress requirements

​Environment variable reference

Prerequisites

Step 1 — Authenticate

Option A — mTLS enrollment (recommended)

Option B — API key (legacy)

Step 2 — Prepare the subnet

Step 3 — Create the Container Instance

Step 4 — Verify the connector is live

Step 5 — Add the device in CertForge

Azure CLI equivalent

Rotating mTLS credentials

Egress requirements

Environment variable reference