You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Tutorial - Updating certificate's auto-rotation frequency in Key Vault | Microsoft Docs
2
+
title: Tutorial - Updating certificate auto-rotation frequency in Key Vault | Microsoft Docs
3
3
description: Tutorial showing how to update a certificate's auto-rotation frequency in Azure Key Vault using the Azure portal
4
4
services: key-vault
5
5
author: msmbaldwin
@@ -12,23 +12,22 @@ ms.topic: tutorial
12
12
ms.custom: mvc
13
13
ms.date: 04/16/2020
14
14
ms.author: sebansal
15
-
#Customer intent:As a security admin who is new to Azure, I want to use Key Vault to securely store certificates in Azure
15
+
#Customer intent:As a security admin who is new to Azure, I want to use Key Vault to securely store certificates in Azure.
16
16
---
17
-
# Tutorial: Configuring certificate's auto-rotation in Key Vault
17
+
# Tutorial: Configure certificate auto-rotation in Key Vault
18
18
19
-
Azure Key Vault lets you easily provision, manage, and deploy digital certificates. They could be public and private SSL/TLS certificates signed by Certificate Authority or a self-signed certificate. Key Vault can also request and renew certificates through partnerships with certificate authorities, providing a robust solution for certificate life cycle management. In this tutorial, you will update certificate's attributes - validity period, auto-rotation frequency, CA. For more information on Key Vault, review the [Overview](../general/overview.md).
19
+
You can easily provision, manage, and deploy digital certificates by using Azure Key Vault. The certificates can be public and private Secure Sockets Layer (SSL)/Transport Layer Security (TLS) certificates signed by a certificate authority (CA), or a self-signed certificate. Key Vault can also request and renew certificates through partnerships with CAs, providing a robust solution for certificate lifecycle management. In this tutorial, you will update a certificate's validity period, auto-rotation frequency, and CA attributes.
20
20
21
21
The tutorial shows you how to:
22
22
23
23
> [!div class="checklist"]
24
-
> * Manage a certificate using Azure portal
25
-
> * Add Certificate Authority provider Account
26
-
> * Update certificate's validity period
27
-
> * Update certificate's auto-rotation frequency
28
-
> * Update certificate's attributes using Azure Powershell
24
+
> * Manage a certificate by using the Azure portal.
25
+
> * Add a CA provider account.
26
+
> * Update the certificate's validity period.
27
+
> * Update the certificate's auto-rotation frequency.
28
+
> * Update the certificate's attributes by using Azure PowerShell.
29
29
30
-
31
-
Before you begin, read [Key Vault basic concepts](../general/basic-concepts.md).
30
+
Before you begin, read [Key Vault basic concepts](../general/basic-concepts.md).
32
31
33
32
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
34
33
@@ -38,75 +37,76 @@ Sign in to the Azure portal at https://portal.azure.com.
38
37
39
38
## Create a vault
40
39
41
-
Create or select your existing Key Vault to perform operations. [(Steps to create a Key vault).](../quick-create-portal.md) In the example, the Vault name is **Example-Vault**.
40
+
Create a key vault or select your existing vault to perform operations (see [Steps to create a key vault](../quick-create-portal.md)). In the example, the key vault name is **Example-Vault**.
42
41
43
-
42
+
44
43
45
44
## Create a certificate in Key Vault
46
45
47
-
Create or import a certificate in the vault. [(Steps to create certificate in Key vault).](../quick-create-portal.md) In this case, we work on certificate called **ExampleCertificate**.
46
+
Create a certificate or import a certificate into the key vault (see [Steps to create a certificate in Key Vault](../quick-create-portal.md)). In this case, you'll work on a certificate called **ExampleCertificate**.
48
47
49
-
> [!NOTE]
50
-
> In Azure Key Vault, a certificate's life cycle attributes can be updated both at the time of certificate's creation as well as after it has been created.
51
-
## Updating Certificate's life cycle attributes
48
+
## Update certificate lifecycle attributes
49
+
50
+
In Azure Key Vault, you can update a certificate's lifecycle attributes both before and after the time of certificate creation.
52
51
53
-
A certificate created in the Key Vault can be
54
-
- a self-signed certificate
55
-
- a certificate created with a Certificate Authority (CA) that is partnered with Key Vault
56
-
- a certificate with a Certificate Authority that is not partnered with Key Vault
52
+
A certificate created in Key Vault can be:
57
53
58
-
The following Certificate Authorities are currently partnered providers with Key Vault:
59
-
-DigiCert - Key Vault offers OV TLS/SSL certificates with DigiCert.
60
-
-GlobalSign - Key Vault offers OV TLS/SSL certificates with GlobalSign.
54
+
- A self-signed certificate.
55
+
-A certificate created with a CA that's partnered with Key Vault.
56
+
-A certificate with a CA that isn't partnered with Key Vault.
61
57
62
-
Azure Key Vault auto-rotates certificates through partnerships with certificate authorities. Through that established partnership, Key Vault automatically requests and renews certificates. Therefore, **auto-rotation capability is not applicable for certificates created with CAs that are not partnered with Key Vault.**
58
+
The following CAs are currently partnered providers with Key Vault:
59
+
60
+
- DigiCert: Key Vault offers OV TLS/SSL certificates.
61
+
- GlobalSign: Key Vault offers OV TLS/SSL certificates.
62
+
63
+
Key Vault auto-rotates certificates through established partnerships with CAs. Because Key Vault automatically requests and renews certificates through the partnership, auto-rotation capability is not applicable for certificates created with CAs that are not partnered with Key Vault.
63
64
64
65
> [!NOTE]
65
-
> An account admin for a CA provider creates credentials to be used by Key Vault to create, renew, and use TLS/SSL certificates via Key Vault.
66
+
> An account admin for a CA provider creates credentials that Key Vault uses to create, renew, and use TLS/SSL certificates.
### Updating Certificate's life cycle attributes at the time of Certificate creation
70
+
### Update certificate lifecycle attributes at the time of creation
71
71
72
72
1. On the Key Vault properties pages, select **Certificates**.
73
-
2. Click on **Generate/Import**.
74
-
3. On the **Create a certificate** screen update the following values:
75
-
73
+
1. Select **Generate/Import**.
74
+
1. On the **Create a certificate** screen, update the following values:
75
+
76
+
-**Validity Period**: Enter the value (in months). Creating short-lived certificates is a recommended security practice. By default, the validity value of a newly created certificate is 12 months.
77
+
-**Lifetime Action Type**: Select the certificate's auto-renewal and alerting action and then update **percentage lifetime** or **Number of days before expiry**. By default, a certificate's auto-renewal is set at 80 percent of its lifetime. From the drop-down menu, select one of the following options.
76
78
77
-
-**Validity Period**: Enter the value (in months). Creating short lived certificates is a recommended security practice. By default validity value of a newly created certificate is 12 months.
78
-
-**Lifetime Action Type**: Select certificate's auto-renewal and alerting action. As per the selection, update 'percentage lifetime' or 'Number of days before expiry'. By default, a certificate's auto-renewal is set at 80% of its lifetime.<br> From the drop down menu, select the option :
79
+
| Automatically renew at a given time| Email all contacts at a given time |
80
+
|-----------|------|
81
+
|Selecting this option will *turn on* autorotation. | Selecting this option will *not* auto-rotate but will only alert the contacts.|
79
82
80
-
| Automatically renew at a given time| Email all contacts at a given time |
81
-
|-----------|------|
82
-
|Selecting this option will TURN ON autorotation | Selecting this option will NOT auto-rotate, it will only alert the contacts|
### Updating Life cycle attributes of stored certificate
96
+
1. On the **Issuance Policy** screen, update the following values:
91
97
92
-
1. Select the Key Vault.
93
-
2. On the Key Vault properties pages, select **Certificates**.
94
-
3. Select the certificate that you wish to update. In this case, we will work on certificate called **ExampleCertificate**.
95
-
4. Select **Issuance Policy** from the top menu bar.
98
+
-**Validity Period**: Update the value (in months).
99
+
-**Lifetime Action Type**: Select the certificate's auto-renewal and alerting action and then update the **percentage lifetime** or **Number of days before expiry**.
5. On the **Issuance Policy** screen, update the following values:
99
-
-**Validity Period**: Update the value (in months)
100
-
-**Lifetime Action Type**: Select certificate's auto-renewal and alerting action. As per the selection, update the 'percentage lifetime' or 'Number of days before expiry'.
Learn more about the parameters [here](https://docs.microsoft.com/cli/azure/keyvault/certificate?view=azure-cli-latest#az-keyvault-certificate-set-attributes)
134
+
To learn more about the parameters, see [az keyvault certificate](https://docs.microsoft.com/cli/azure/keyvault/certificate?view=azure-cli-latest#az-keyvault-certificate-set-attributes).
134
135
135
136
## Clean up resources
136
137
137
-
Other Key Vault quickstarts and tutorials build upon this quickstart. If you plan to continue on to work with subsequent quickstarts and tutorials, you may wish to leave these resources in place.
138
-
When no longer needed, delete the resource group, which deletes the Key Vault and related resources. To delete the resource group through the portal:
138
+
Other Key Vault tutorials build upon this tutorial. If you plan to work with these tutorials, you might want to leave these existing resources in place.
139
+
When you no longer need them, delete the resource group, which deletes the key vault and related resources.
140
+
141
+
To delete the resource group by using the portal:
139
142
140
-
1. Enter the name of your resource group in the Search box at the top of the portal. When you see the resource group used in this quickstart in the search results, select it.
141
-
2. Select **Delete resource group**.
142
-
3. In the **TYPE THE RESOURCE GROUP NAME:** box type in the name of the resource group and select **Delete**.
143
+
1. Enter the name of your resource group in the **Search** box at the top of the portal. When the resource group used in this quickstart appears in the search results, select it.
144
+
1. Select **Delete resource group**.
145
+
1. In the **TYPE THE RESOURCE GROUP NAME:** box, type the name of the resource group and then select **Delete**.
143
146
144
147
145
148
## Next steps
146
149
147
-
In this tutorial, you updated a certificate's life-cycle. To learn more about Key Vault and how to integrate it with your applications, continue on to the articles below.
150
+
In this tutorial, you updated a certificate's lifecycle attributes. To learn more about Key Vault and how to integrate it with your applications, continue on to the following articles:
148
151
149
-
Read more about [Managing certificate creation in Azure Key Vault](https://docs.microsoft.com/azure/key-vault/certificates/create-certificate-scenarios)
150
-
- Review the [Key Vault Overview](../general/overview.md)
152
+
- Read more about [Managing certificate creation in Azure Key Vault](https://docs.microsoft.com/azure/key-vault/certificates/create-certificate-scenarios).
153
+
- Review the [Key Vault Overview](../general/overview.md).
0 commit comments