{"id":5455,"date":"2017-01-11T22:15:08","date_gmt":"2017-01-11T22:15:08","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/premier_developer\/?p=5455"},"modified":"2019-03-07T11:57:00","modified_gmt":"2019-03-07T18:57:00","slug":"digicert-certificate-management-through-azure-key-vault","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/premier-developer\/digicert-certificate-management-through-azure-key-vault\/","title":{"rendered":"DigiCert Certificate Management through Azure Key Vault"},"content":{"rendered":"

In a recent post from his blog, Application Development Manager Christian Reddington<\/a> walked us through an introduction to Azure Key Vault<\/a>.\u00a0 Azure Key Vault helps safeguard cryptographic keys and secrets used by cloud applications and services.\u00a0 It streamlines the key management process, enabling you to maintain control of keys that access and encrypt your data.\u00a0 Developers can create keys for development and testing in minutes, and then seamlessly migrate them to production keys.\u00a0 Security administrators can grant (and revoke) permission to keys, as needed.<\/p>\n

\n

When designing a solution, you want to be sure that your communications are secure and that your users can trust your application. Typically, SSL certificates can be useful for this purpose.<\/p>\n

That is well and good from a design and development perspective, but there may some management headaches when operating and governing the solution. How do you keep track of the certificates? How do you guarantee that they are kept secure? How do you ensure that certificates renew on time?<\/p>\n

Azure\u2019s Key Vault can help in this area. Recently, at Microsoft Ignite 2016\u2013 The team announced that Azure Key Vault supports management of certificates from supported Certificate Authorities (so far, this includes DigiCert, GlobalSign and WoSign). The process is well-documented here<\/a>. My personal domain name has an SSL validated by DigiCert, so I am going to use the previously linked blog process, and step through the process \u2013 showing the output along the way.<\/p>\n

1.<\/strong> Firstly, log in to your Azure Account via the Resource Management PowerShell cmdlets. Double check which subscriptions you have access to, and that you have set a default subscription context.<\/p>\n

\"\"<\/p>\n

2.<\/strong> Set variables for $vaultName, $resourceGroupName and $Location and use the command New-AzureRmKeyVault -VaultName $vaultName -ResourceGroupName $resourceGroupName -Location $location<\/strong> to create an Azure Key Vault, if you do not have one. As you can see in the screenshot below, my key vault already exists.<\/p>\n

\"\"<\/p>\n

3.<\/strong> Now that you have an Azure Key Vault, you need to link this to your organisation for your Certificate Authority issuer. There are a few pieces of information needed to get this going. Specifically, for DigiCert, you can find this here<\/a>.<\/p>\n

a.<\/strong>\u00a0 $orgIdentifier \u2013 The organisation ID associated with your CertCentral account on DigiCert.<\/p>\n

b.<\/strong>\u00a0 $apiKey \u2013 You need to create an API Key through DigiCert CertCentral interface. The API key is a relatively long alphanumeric string.<\/p>\n

c.<\/strong>\u00a0 $accountId \u2013 This is the id of your DigiCert account.<\/p>\n

d.<\/strong>\u00a0 $issuerName \u2013 Something that makes sense to you, for the issuer of your certificate with the Certificate Authority. In my case, I have used DigiCert and my initials, as it relates to my personal domain.<\/p>\n

Finally, use the Set-AzureKeyVaultCertificateIssuer<\/strong> cmdlet with the associated parameters in the image below to ensure the Certificate Issuer is associated with your KeyVault account.\nNOTE: These steps differ depending on your certificate authority. You should check these out on the Key Vault blog <\/b>here<\/a>, for either GlobalSign or WoSign. <\/b><\/p>\n

\"\"<\/p>\n

4.<\/strong> Now that we have created the link to the issuer, we should create a certificate policy. The policy focuses on the information included in the certificate, when to renew it, and details on the Certificate Authority where the renewal takes place. Below, you can see that I have provided details for a wildcard to my personal domain name, that the certificate should be valid for 12 months and should be renewed 60 days before expiry.<\/p>\n

5.<\/strong> Now use the details from the above policy, to create a certificate in the Key Vault. The CertificateName parameter (in my case, $certificateName) is the name of the certificate object as held in the Key Vault, not the name of the certificate with your Certificate Authority.<\/p>\n

\"\"<\/p>\n

6.<\/strong> Once you have completed this step, you have submitted a request to DigiCert for the certificate, containing the details of the policy that you created earlier. You can check on the progress by using the cmdlet Get-AzureKeyVaultCertificateOperation<\/strong>, passing in a parameter for VaultName and CertificateName (e.g. as shown below). You can also see that the request has appeared in your DigiCert CertCentral account.<\/p>\n

\"\"<\/p>\n

\"\"<\/span><\/u><\/p>\n

7.<\/strong> You may be contacted by the Certificate Authority to validate details of the organisation requesting the certificate or may need additional details for the Certificate Signing Request. Once complete, you can use the Get-AzureKeyVaultCertificate<\/strong> command, passing in the $vaultName and $certificateName parameters, to find the details needed to access the certificate from Key Vault.<\/p>\n

\"\"<\/p>\n

Congratulations<\/strong>, you have now generated a certificate, which has been signed by DigiCert via Azure Key Vault. You can now go and use one of the documented ARM templates, to import Key Vault certificates into your resources. For example, see here on using a certificate within Azure Web App<\/a>.<\/p>\n

However, if you are using the Resource Manager API to deploy your certificates from Key Vault to your resources, you need to ensure that the Key Vault Access Policy allows this;<\/p>\n

Set-AzureRmKeyVaultAccessPolicy -VaultName $vaultName -ServicePrincipalName <YourServicePrincipal> -PermissionsToSecrets get<\/strong><\/p>\n

 <\/p>\n

PS<\/strong> \u2013 If you had not spotted it previously, the Azure Key Vault team have an official blog <\/em>here<\/em><\/a>!<\/em><\/p>\n

PPS<\/strong> \u2013 This post bases itself on the blog written by the Key Vault team, <\/em>here<\/em><\/a>. The aim of this post is to provide a few extra screenshots and focus on the process specifically for DigiCert. I have missed out a few details that are covered by the Key Vault team on certificate renewal. I have also missed out using Key Vault for SSL on Web apps, which are again worth checking out in the blog post referenced above.<\/em><\/p>\n

\n

Premier Support for Developers<\/strong><\/a> provides strategic technology guidance, critical support coverage, and a range of essential services to help teams optimize development lifecycles and improve software quality.\u00a0 Contact your Application Development Manager (ADM) or email us<\/a> to learn more about what we can do for you.<\/p>\n","protected":false},"excerpt":{"rendered":"

In a recent post from his blog, Application Development Manager Christian Reddington walked us through an introduction to Azure Key Vault.\u00a0 Azure Key Vault helps safeguard cryptographic keys and secrets used by cloud applications and services.\u00a0 It streamlines the key management process, enabling you to maintain control of keys that access and encrypt your data.\u00a0 […]<\/p>\n","protected":false},"author":582,"featured_media":37840,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[25],"tags":[24,172,256,3],"class_list":["post-5455","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","tag-azure","tag-certificates","tag-key-vault","tag-team"],"acf":[],"blog_post_summary":"

In a recent post from his blog, Application Development Manager Christian Reddington walked us through an introduction to Azure Key Vault.\u00a0 Azure Key Vault helps safeguard cryptographic keys and secrets used by cloud applications and services.\u00a0 It streamlines the key management process, enabling you to maintain control of keys that access and encrypt your data.\u00a0 […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts\/5455","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/users\/582"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/comments?post=5455"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/posts\/5455\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/media\/37840"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/media?parent=5455"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/categories?post=5455"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/premier-developer\/wp-json\/wp\/v2\/tags?post=5455"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}