Azure Key Vault Certificates

# Create a resource group
az group create \
  --name rg-certificates \
  --location eastus

# Create a Key Vault with RBAC, soft-delete, and purge protection
az keyvault create \
  --name kv-myapp-certs \
  --resource-group rg-certificates \
  --location eastus \
  --enable-rbac-authorization true \
  --enable-soft-delete true \
  --enable-purge-protection true \
  --soft-delete-retention-days 90

# Create a resource group
New-AzResourceGroup -Name "rg-certificates" -Location "eastus"

# Create a Key Vault with RBAC and purge protection
New-AzKeyVault `
  -VaultName "kv-myapp-certs" `
  -ResourceGroupName "rg-certificates" `
  -Location "eastus" `
  -EnableRbacAuthorization `
  -EnablePurgeProtection `
  -SoftDeleteRetentionInDays 90

# Import a PFX certificate with password
az keyvault certificate import \
  --vault-name kv-myapp-certs \
  --name myapp-tls \
  --file ./myapp.pfx \
  --password "YourPfxPassword"

# Import a PEM certificate (must include private key)
# Combine cert + key into single PEM file first:
# cat cert.pem key.pem > combined.pem
az keyvault certificate import \
  --vault-name kv-myapp-certs \
  --name myapp-tls \
  --file ./combined.pem

$password = ConvertTo-SecureString -String "YourPfxPassword" -AsPlainText -Force
Import-AzKeyVaultCertificate `
  -VaultName "kv-myapp-certs" `
  -Name "myapp-tls" `
  -FilePath "./myapp.pfx" `
  -Password $password

# PEM to PFX (for Key Vault import)
openssl pkcs12 -export \
  -out certificate.pfx \
  -inkey private.key \
  -in certificate.crt \
  -certfile chain.crt \
  -password pass:YourPassword

# PFX to PEM (extract from PFX)
openssl pkcs12 -in certificate.pfx \
  -out combined.pem \
  -nodes \
  -password pass:YourPassword

# Create a self-signed certificate with JSON policy
az keyvault certificate create \
  --vault-name kv-myapp-certs \
  --name myapp-internal \
  --policy '{
    "issuerParameters": { "name": "Self" },
    "keyProperties": {
      "keyType": "RSA",
      "keySize": 2048,
      "exportable": true,
      "reuseKey": false
    },
    "secretProperties": { "contentType": "application/x-pkcs12" },
    "x509CertificateProperties": {
      "subject": "CN=myapp.internal.example.com",
      "validityInMonths": 12,
      "subjectAlternativeNames": {
        "dnsNames": ["myapp.internal.example.com", "myapp.dev.example.com"]
      }
    }
  }'

# Step 1: Create certificate request (generates CSR in vault)
az keyvault certificate create \
  --vault-name kv-myapp-certs \
  --name myapp-public \
  --policy '{
    "issuerParameters": { "name": "Unknown" },
    "keyProperties": { "keyType": "RSA", "keySize": 2048, "exportable": true },
    "x509CertificateProperties": {
      "subject": "CN=myapp.example.com",
      "validityInMonths": 12,
      "subjectAlternativeNames": {
        "dnsNames": ["myapp.example.com", "www.myapp.example.com"]
      }
    }
  }'

# Step 2: Download the CSR
az keyvault certificate pending show \
  --vault-name kv-myapp-certs \
  --name myapp-public \
  --query csr -o tsv > myapp.csr

# Step 3: Submit CSR to your CA (external step)
# Your CA returns a signed certificate (e.g., signed-cert.crt)

# Step 4: Merge the signed certificate
az keyvault certificate pending merge \
  --vault-name kv-myapp-certs \
  --name myapp-public \
  --file signed-cert.crt

# Configure the CA issuer (one-time setup)
az keyvault certificate issuer create \
  --vault-name kv-myapp-certs \
  --issuer-name DigiCertIssuer \
  --provider-name DigiCert \
  --account-id "YOUR_DIGICERT_ACCOUNT_ID" \
  --password "YOUR_DIGICERT_API_KEY"

# Create a certificate using the integrated CA
az keyvault certificate create \
  --vault-name kv-myapp-certs \
  --name myapp-production \
  --policy '{
    "issuerParameters": { "name": "DigiCertIssuer" },
    "keyProperties": { "keyType": "RSA", "keySize": 2048, "exportable": true },  // set false if policy disallows export
    "x509CertificateProperties": {
      "subject": "CN=myapp.example.com",
      "validityInMonths": 12,
      "subjectAlternativeNames": {
        "dnsNames": ["myapp.example.com", "www.myapp.example.com"]
      }
    },
    "lifetimeActions": [
      { "action": { "actionType": "AutoRenew" }, "trigger": { "daysBeforeExpiry": 30 } }
    ]
  }'

# Update certificate policy with auto-renewal
az keyvault certificate set-attributes \
  --vault-name kv-myapp-certs \
  --name myapp-production \
  --policy '{
    "lifetimeActions": [
      {
        "action": { "actionType": "AutoRenew" },
        "trigger": { "daysBeforeExpiry": 30 }
      }
    ]
  }'

# Set up email notification before expiry
az keyvault certificate set-attributes \
  --vault-name kv-myapp-certs \
  --name myapp-tls \
  --policy '{
    "lifetimeActions": [
      {
        "action": { "actionType": "EmailContacts" },
        "trigger": { "daysBeforeExpiry": 30 }
      }
    ]
  }'

# Add certificate contacts for notifications
az keyvault certificate contact add \
  --vault-name kv-myapp-certs \
  --email "[email protected]" \
  --name "PKI Team" \
  --phone "555-0100"

# Create an Event Grid subscription for certificate events
az eventgrid event-subscription create \
  --name cert-expiry-alert \
  --source-resource-id $(az keyvault show --name kv-myapp-certs --query id -o tsv) \
  --endpoint https://myapp.azurewebsites.net/api/cert-webhook \
  --included-event-types \
    Microsoft.KeyVault.CertificateNearExpiry \
    Microsoft.KeyVault.CertificateExpired \
    Microsoft.KeyVault.CertificateNewVersionCreated

# Create a user-assigned managed identity
az identity create \
  --name appgw-identity \
  --resource-group rg-certificates

# Get the identity's principal ID
IDENTITY_ID=$(az identity show \
  --name appgw-identity \
  --resource-group rg-certificates \
  --query principalId -o tsv)

# Assign Key Vault Certificate User role
az role assignment create \
  --assignee $IDENTITY_ID \
  --role "Key Vault Certificate User" \
  --scope $(az keyvault show --name kv-myapp-certs --query id -o tsv)

# Reference certificate in App Gateway (versionless URI)
# Use the SECRET URI, not the certificate URI:
# https://kv-myapp-certs.vault.azure.net/secrets/myapp-tls

# Import Key Vault certificate to App Service
az webapp config ssl import \
  --resource-group rg-myapp \
  --name myapp-webapp \
  --key-vault kv-myapp-certs \
  --key-vault-certificate-name myapp-tls

# Enable the Secrets Store CSI Driver addon on AKS
az aks enable-addons \
  --resource-group rg-myapp \
  --name myapp-aks \
  --addons azure-keyvault-secrets-provider

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: kv-tls-cert
spec:
  provider: azure
  parameters:
    clientID: "<workload-identity-client-id>"   # Workload identity (recommended)
    keyvaultName: "kv-myapp-certs"
    tenantId: "<your-tenant-id>"
    objects: |
      array:
        - |
          objectName: myapp-tls
          objectType: secret
  secretObjects:                                 # Sync to a k8s Secret for TLS ingress
    - secretName: myapp-tls-secret
      type: kubernetes.io/tls
      data:
        - objectName: myapp-tls
          key: tls.key
        - objectName: myapp-tls
          key: tls.crt

# Mount in your pod spec (volumes + volumeMounts)
spec:
  serviceAccountName: myapp-sa    # SA annotated with workload identity
  containers:
    - name: myapp
      volumeMounts:
        - name: tls-cert
          mountPath: "/mnt/certs"
          readOnly: true
  volumes:
    - name: tls-cert
      csi:
        driver: secrets-store.csi.k8s.io
        readOnly: true
        volumeAttributes:
          secretProviderClass: kv-tls-cert

# Enable system-assigned managed identity on APIM (via Azure Resource Manager)
az resource update --ids $(az apim show --name myapp-apim \
  --resource-group rg-myapp --query id -o tsv) \
  --set identity.type=SystemAssigned

# Get APIM's principal ID
APIM_PRINCIPAL=$(az apim show --name myapp-apim --resource-group rg-myapp \
  --query identity.principalId -o tsv)

# Grant Key Vault access
az role assignment create --assignee $APIM_PRINCIPAL \
  --role "Key Vault Certificate User" \
  --scope $(az keyvault show --name kv-myapp-certs --query id -o tsv)

# In the portal: APIM → Custom domains → Add → select Key Vault certificate
# Reference: https://kv-myapp-certs.vault.azure.net/secrets/myapp-tls

# Download the public certificate (no private key)
az keyvault certificate download \
  --vault-name kv-myapp-certs \
  --name myapp-tls \
  --file myapp-public.pem \
  --encoding PEM

# Get the full certificate + private key via the secret object
az keyvault secret download \
  --vault-name kv-myapp-certs \
  --name myapp-tls \
  --file myapp-full.pfx \
  --encoding base64

# Export certificate with private key (PowerShell)
$secret = Get-AzKeyVaultSecret -VaultName "kv-myapp-certs" -Name "myapp-tls"
$secretBytes = [Convert]::FromBase64String($secret.SecretValueText)
[IO.File]::WriteAllBytes("myapp-export.pfx", $secretBytes)

# Convert to PEM if needed
openssl pkcs12 -in myapp-export.pfx -out myapp-export.pem -nodes

Certificate import failing?
├─ "Private key is not specified"
│  └─ PEM file is missing the private key block
│     → Concatenate: cat cert.pem key.pem > combined.pem
├─ "Unable to parse X5c chain"
│  └─ Malformed PEM (extra whitespace, Windows line endings)
│     → Run: dos2unix combined.pem && openssl x509 -in cert.pem -noout
├─ "Certificate name already exists"
│  └─ A secret or key with the same name exists
│     → Delete conflicting object or use a different name
├─ "Specified content type not valid"
│  └─ File format doesn't match extension
│     → Verify: file certificate.pfx (should show PKCS#12)
└─ Certificate expired
   └─ Key Vault rejects expired certificates
      → Obtain a renewed certificate first

Certificate stuck "In Progress"?
├─ Using integrated CA (DigiCert/GlobalSign)?
│  └─ Check issuer credentials and account status
│     → az keyvault certificate issuer show --vault-name <vault> --issuer-name <issuer>
├─ Using CSR workflow (Unknown issuer)?
│  └─ Waiting for you to merge the signed certificate
│     → Download CSR, submit to CA, then merge signed cert
└─ DNS validation pending?
   └─ CA is waiting for domain validation
      → Check your DNS records and CA dashboard

Application Gateway not picking up new cert?
├─ Using versioned URI?
│  └─ Versioned URIs point to a specific version forever
│     → Switch to versionless URI (remove version segment)
├─ Using /certificates/ URI instead of /secrets/?
│  └─ App Gateway needs /secrets/ for the private key
│     → Change to: https://<vault>.vault.azure.net/secrets/<name>
├─ Managed identity permissions changed?
│  └─ Identity lost Key Vault access
│     → Re-assign Key Vault Certificate User role
├─ Key Vault firewall blocking?
│  └─ Firewall rules exclude App Gateway
│     → Allow trusted Microsoft services or add App Gateway subnet
└─ Polling delay (up to 4 hours)?
   └─ App Gateway checks Key Vault every 4 hours
      → Wait for next poll cycle or restart the App Gateway

# Verify the exported certificate
openssl x509 -in myapp-public.pem -text -noout

# Check certificate chain
openssl verify -CAfile chain.pem myapp-public.pem

# Test TLS connection to your endpoint
openssl s_client -connect myapp.example.com:443 -servername myapp.example.com