Connector in Azure

Deploy certforge-connector as an Azure Container Instance (ACI) inside your VNet so it can reach F5 BIG-IP, Ribbon SBCs, and other devices on private management addresses. No inbound firewall rules are required — the connector makes outbound calls only.

Prerequisites

Azure subscription with Contributor rights on the resource group
An existing VNet that routes to the device management subnet
NSG rule allowing TCP from the ACI subnet to the device management port (443 by default, 8443 for unlicensed F5)
A CertForge account with admin or operator role

Step 1 — Get your API key from CertForge

The connector authenticates with an API key tied to a named Connector Agent record.

In CertForge go to Integrations → Connector Agents → Add Agent
Name it something descriptive (e.g. azure-northcentralus) and save
Copy the generated key — it starts with ct_ and is shown once only

Step 2 — Prepare the subnet

ACI requires a subnet delegated exclusively to Microsoft.ContainerInstance/containerGroups. A dedicated subnet is cleaner than sharing one with other resources. In the Azure Portal go to Virtual networks → YOUR_VNET → Subnets → + Subnet:

Field	Value
Name	`certforge-connector` (or any descriptive name)
Size	`/29` — smallest valid; ACI only needs one IP
Subnet delegation	`Microsoft.ContainerInstance/containerGroups`

A delegated subnet cannot contain other resource types (VMs, load balancers). Create a dedicated one.

Step 3 — Create the Container Instance

In the Azure Portal go to Container instances → + Create. Basics tab

Field	Value
Container name	`certforge-connector`
Region	Same region as your VNet
Image source	Other registry
Image	`ghcr.io/certforge-llc/certforge-connector:latest`
OS type	Linux
Size	1 vCPU, 1 GiB memory

Networking tab

Field	Value
Networking type	Private — enables VNet integration, private IP only
Virtual network	Your VNet
Subnet	The subnet from step 2
Ports	Delete any pre-filled ports — no inbound ports needed

Advanced tab Add two environment variables:

Name	Value	Secure
`CERTFORGE_URL`	`https://app.certgovernance.app`	No
`CERTFORGE_API_KEY`	`ct_YOUR_KEY`	Yes

Set Restart policy to Always.

No config file is needed. The connector runs entirely from these two environment variables — no YAML file required.

Click Review + create, then Create. Deployment takes about 60–90 seconds.

Step 4 — Verify the connector is live

Once running, check the logs from the Azure CLI:

az container logs \
  --resource-group YOUR_RG \
  --name certforge-connector \
  --follow

You should see the connector register its device capabilities and start polling:

[connector] starting v0.2.x - polling https://app.certgovernance.app every 30s

In CertForge, go to Integrations → Connector Agents — the agent should show a green Last seen timestamp within a minute.

If the container keeps restarting (ExitCode 1), check the logs for an auth error. The most common cause is a typo in the API key. Delete and recreate the container with the corrected value — environment variables on a running ACI instance cannot be edited in place.

Step 5 — Add the device in CertForge

With the connector inside the VNet, register the device using its private management IP:

Go to Integrations → Network Devices → Add Device
Set Type to f5, ribbon, or the appropriate driver
Enter the private management IP and port
Enter credentials and configure TLS settings
Click Query Cert to confirm connectivity

Azure CLI equivalent

If you prefer scripting:

# Delegate the subnet (if not already done)
az network vnet subnet update \
  --resource-group YOUR_RG \
  --vnet-name      YOUR_VNET \
  --name           YOUR_SUBNET \
  --delegations    Microsoft.ContainerInstance/containerGroups

# Deploy the container
az container create \
  --resource-group YOUR_RG \
  --name           certforge-connector \
  --location       YOUR_REGION \
  --image          ghcr.io/certforge-llc/certforge-connector:latest \
  --vnet           YOUR_VNET \
  --subnet         YOUR_SUBNET \
  --os-type        Linux \
  --cpu 1 --memory 1 \
  --restart-policy Always \
  --environment-variables \
      CERTFORGE_URL=https://app.certgovernance.app \
  --secure-environment-variables \
      CERTFORGE_API_KEY=ct_YOUR_KEY

To update the container after a new release, delete and recreate it — ACI does not re-pull :latest on a running instance:

az container delete --resource-group YOUR_RG --name certforge-connector --yes
# then run the create command above

Environment variable reference

Variable	Required	Description
`CERTFORGE_URL`	Yes	CertForge instance URL
`CERTFORGE_API_KEY`	Yes	API key from Connector Agents. Starts with `ct_`. Mark as Secure.
`CERTFORGE_POLL`	No	Poll interval. Default: `30s`. Accepts Go duration strings (`1m`, `2m`).

​Prerequisites

​Step 1 — Get your API key from CertForge

​Step 2 — Prepare the subnet

​Step 3 — Create the Container Instance

​Step 4 — Verify the connector is live

​Step 5 — Add the device in CertForge

​Azure CLI equivalent

​Environment variable reference

Prerequisites

Step 1 — Get your API key from CertForge

Step 2 — Prepare the subnet

Step 3 — Create the Container Instance

Step 4 — Verify the connector is live

Step 5 — Add the device in CertForge

Azure CLI equivalent

Environment variable reference