How do I add Cloudflare as a DNS provider?

[anthonyvia]

How do I add Cloudflare as a DNS provider to an already running instance of this app?

We recently moved one of our domains from Azure DNS to Cloudflare DNS. I am attempting to add the Acmebot:Cloudflare:ApiToken environment variable via the Function App->Settings->Environment Variables blade within the Azure portal, so that cert renewals for certs using said moved domain can use Cloudflare instead of Azure DNS. However, the environment variable gets automatically deleted immediately after adding it. I see support for multiple DNS providers was added in #476, so I assumed the app wouldn't reject this change.

Apologies if I missed this somewhere, I searched issues/discussions/wiki the best I could.

[anthonyvia]

Update: I attempted adding the setting via CLI and was met with this warning: Invalid version: 4.0 for runtime dotnet and os windows. Supported versions for runtime dotnet and os windows are: ['8', '6']. Run 'az functionapp list-runtimes' for more details on supported runtimes. So I found this announcement on upgrading to .NET 8, which fixed my env var not persisting issue.

However, I have another issue now where cert renewal for certs on this domain that was migrated are still attempting to use Azure DNS instead of Cloudflare:

Orchestrator function 'RenewCertificate_Orchestrator' failed: The orchestrator function 'IssueCertificate' failed: "The activity function 'Dns01Precondition' failed: "The delegated name server is not correct. DNS zone = <REDACTED>, Expected = ns1-08.azure-dns.com,ns2-08.azure-dns.net,ns3-08.azure-dns.org,ns4-08.azure-dns.info, Actual = meadow.ns.cloudflare.com,rohin.ns.cloudflare.com". See the function execution logs for additional details.". See the function execution logs for additional details.

I did verify that my domain is listed under Cloudflare from the DNS providers list when creating a new cert via the Function web app. I may just need to delete the old cert and re-create?

[anthonyvia]

Update: I found this discussion on updating the DNS provider for a cert. I followed the same steps, and can see the correct DNS Provider listed for the cert via the Function's web app, but renewal fails with the same error from my last comment.

[anthonyvia]

If I attempt to create a new cert under this domain while specifying Cloudflare as the DNS Provider I also get the same error. There must be another config somewhere to tell the Function which domains belong to which providers?

[anthonyvia]

RESOLVED! I removed the DNS Contributor role assignment between the Function app and the DNS zone with Azure and that fixed everything. The domain is only listed under Cloudflare now and my certs are renewing as expected.