You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/virtual-machines/windows/tutorial-secure-web-server.md
+36-35Lines changed: 36 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,48 +1,48 @@
1
1
---
2
-
title: "Tutorial: Secure a Windows web server with TLS/SSL certificates in Azure"
3
-
description: In this tutorial, you learn how to use Azure PowerShell to secure a Windows virtual machine that runs the IIS web server with TLS/SSL certificates stored in Azure Key Vault.
2
+
title: "Tutorial: Secure a Windows web server with TLS certificates in Azure"
3
+
description: Learn how to use Azure PowerShell to secure a Windows virtual machine that runs the IIS web server with TLS certificates stored in Azure Key Vault.
4
4
author: cynthn
5
5
ms.service: virtual-machines
6
6
ms.collection: windows
7
7
ms.subservice: security
8
8
ms.topic: tutorial
9
9
ms.workload: infrastructure
10
-
ms.date: 02/09/2018
10
+
ms.date: 04/05/2023
11
11
ms.author: cynthn
12
12
ms.custom: mvc, devx-track-azurepowershell
13
13
14
-
#Customer intent: As an IT administrator or developer, I want to learn how to secure a web server with TLS/SSL certificates so that I can protect my customer data on web applications that I build and run.
14
+
#Customer intent: As an IT administrator or developer, I want to learn how to secure a web server with TLS certificates so that I can protect my customer data on web applications that I build and run.
15
15
---
16
16
17
-
# Tutorial: Secure a web server on a Windows virtual machine in Azure with TLS/SSL certificates stored in Key Vault
18
-
**Applies to:**:heavy_check_mark: Windows VMs :heavy_check_mark: Flexible scale sets
17
+
# Tutorial: Secure a web server on a Windows virtual machine in Azure with TLS certificates stored in Key Vault
18
+
19
+
**Applies to:**:heavy_check_mark: Windows VMs :heavy_check_mark: Flexible scale sets
19
20
20
21
> [!NOTE]
21
-
> Currently this doc only works for Generalized images. If attempting this tutorial using a Specialized disk you will receive an error.
22
+
> Currently, this doc only works for Generalized images. If you attempt this tutorial by using a Specialized disk you will receive an error.
22
23
23
-
To secure web servers, a Transport Layer Security (TLS), previously known as Secure Sockets Layer (SSL), certificate can be used to encrypt web traffic. These TLS/SSL certificates can be stored in Azure Key Vault, and allow secure deployments of certificates to Windows virtual machines (VMs) in Azure. In this tutorial you learn how to:
24
+
To secure web servers, a Transport Layer Security (TLS)certificate can be used to encrypt web traffic. TLS certificates can be stored in Azure Key Vault and allow secure deployments of certificates to Windows virtual machines (VMs) in Azure. In this tutorial you learn how to:
24
25
25
26
> [!div class="checklist"]
26
-
> * Create an Azure Key Vault
27
-
> * Generate or upload a certificate to the Key Vault
28
-
> * Create a VM and install the IIS web server
29
-
> * Inject the certificate into the VM and configure IIS with a TLS binding
30
-
27
+
> * Create an Azure Key Vault.
28
+
> * Generate or upload a certificate to the Key Vault.
29
+
> * Create a VM and install the IIS web server.
30
+
> * Inject the certificate into the VM and configure IIS with a TLS binding.
31
31
32
32
## Launch Azure Cloud Shell
33
33
34
-
The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.
35
-
36
-
To open the Cloud Shell, just select **Try it** from the upper right corner of a code block. You can also launch Cloud Shell in a separate browser tab by going to [https://shell.azure.com/powershell](https://shell.azure.com/powershell). Select **Copy** to copy the blocks of code, paste it into the Cloud Shell, and press enter to run it.
34
+
The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.
37
35
36
+
To open the Cloud Shell, just select **Open Cloudshell** from the upper right corner of a code block. You can also launch Cloud Shell in a separate browser tab by going to [https://shell.azure.com/powershell](https://shell.azure.com/powershell). Select **Copy** to copy the blocks of code, paste them into the Cloud Shell, and press enter to run them.
38
37
39
38
## Overview
40
-
Azure Key Vault safeguards cryptographic keys and secrets, such certificates or passwords. Key Vault helps streamline the certificate management process and enables you to maintain control of keys that access those certificates. You can create a self-signed certificate inside Key Vault, or upload an existing, trusted certificate that you already own.
41
39
42
-
Rather than using a custom VM image that includes certificates baked-in, you inject certificates into a running VM. This process ensures that the most up-to-date certificates are installed on a web server during deployment. If you renew or replace a certificate, you don't also have to create a new custom VM image. The latest certificates are automatically injected as you create additional VMs. During the whole process, the certificates never leave the Azure platform or are exposed in a script, command-line history, or template.
40
+
Azure Key Vault safeguards cryptographic keys and secrets, such as certificates or passwords. Key Vault helps streamline the certificate management process and enables you to maintain control of keys that access those certificates. You can create a self-signed certificate inside Key Vault, or you can upload an existing, trusted certificate that you already own.
43
41
42
+
Rather than by using a custom VM image that includes certificates baked-in, inject certificates into a running VM. This process ensures that the most up-to-date certificates are installed on a web server during deployment. If you renew or replace a certificate, you don't also have to create a new custom VM image. The latest certificates are automatically injected as you create more VMs. During the whole process, the certificates never leave the Azure platform or are exposed in a script, command-line history, or template.
44
43
45
44
## Create an Azure Key Vault
45
+
46
46
Before you can create a Key Vault and certificates, create a resource group with [New-AzResourceGroup](/powershell/module/az.resources/new-azresourcegroup). The following example creates a resource group named *myResourceGroupSecureWeb* in the *East US* location:
Next, create a Key Vault with [New-AzKeyVault](/powershell/module/az.keyvault/new-azkeyvault). Each Key Vault requires a unique name, and should be all lower case. Replace `mykeyvault`in the following example with your own unique Key Vault name:
54
+
Next, create a Key Vault with [New-AzKeyVault](/powershell/module/az.keyvault/new-azkeyvault). Each Key Vault requires a unique name and should be all lower case. Replace `mykeyvault` with your own unique Key Vault name in the following example:
For production use, you should import a valid certificate signed by trusted provider with [Import-AzKeyVaultCertificate](/powershell/module/az.keyvault/import-azkeyvaultcertificate). For this tutorial, the following example shows how you can generate a self-signed certificate with [Add-AzKeyVaultCertificate](/powershell/module/az.keyvault/add-azkeyvaultcertificate) that uses the default certificate policy from [New-AzKeyVaultCertificatePolicy](/powershell/module/az.keyvault/new-azkeyvaultcertificatepolicy).
64
+
## Generate a certificate and store it in Key Vault
65
+
66
+
For production use, you should import a valid certificate signed by a trusted provider with [Import-AzKeyVaultCertificate](/powershell/module/az.keyvault/import-azkeyvaultcertificate). For this tutorial, the following example shows how you can generate a self-signed certificate with [Add-AzKeyVaultCertificate](/powershell/module/az.keyvault/add-azkeyvaultcertificate) that uses the default certificate policy from [New-AzKeyVaultCertificatePolicy](/powershell/module/az.keyvault/new-azkeyvaultcertificatepolicy).
66
67
67
68
```azurepowershell-interactive
68
69
$policy = New-AzKeyVaultCertificatePolicy `
@@ -77,15 +78,15 @@ Add-AzKeyVaultCertificate `
77
78
-CertificatePolicy $policy
78
79
```
79
80
80
-
81
81
## Create a virtual machine
82
+
82
83
Set an administrator username and password for the VM with [Get-Credential](/powershell/module/microsoft.powershell.security/get-credential):
83
84
84
85
```azurepowershell-interactive
85
86
$cred = Get-Credential
86
87
```
87
88
88
-
Now you can create the VM with [New-AzVM](/powershell/module/az.compute/new-azvm). The following example creates a VM named *myVM* in the *EastUS* location. If they do not already exist, the supporting network resources are created. To allow secure web traffic, the cmdlet also opens port *443*.
89
+
Now you can create the VM with [New-AzVM](/powershell/module/az.compute/new-azvm). The following example creates a VM named *myVM* in the *EastUS* location. If they don't already exist, the supporting network resources are created. To allow secure web traffic, the cmdlet also opens port *443*.
It takes a few minutes for the VM to be created. The last step uses the Azure Custom Script Extension to install the IIS web server with [Set-AzVmExtension](/powershell/module/az.compute/set-azvmextension).
115
116
116
-
117
117
## Add a certificate to VM from Key Vault
118
+
118
119
To add the certificate from Key Vault to a VM, obtain the ID of your certificate with [Get-AzKeyVaultSecret](/powershell/module/az.keyvault/get-azkeyvaultsecret). Add the certificate to the VM with [Add-AzVMSecret](/powershell/module/az.compute/add-azvmsecret):
Use the Custom Script Extension again with [Set-AzVMExtension](/powershell/module/az.compute/set-azvmextension) to update the IIS configuration. This update applies the certificate injected from Key Vault to IIS and configures the web binding:
Obtain the public IP address of your VM with [Get-AzPublicIPAddress](/powershell/module/az.network/get-azpublicipaddress). The following example obtains the IP address for `myPublicIP` created earlier:
Now you can open a web browser and enter `https://<myPublicIP>` in the address bar. To accept the security warning if you used a self-signed certificate, select **Details** and then **Go on to the webpage**:
159
160
160
-
161
+
:::image type="content" source="./media/tutorial-secure-web-server/browser-warning.png" alt-text="Screenshot of web browser security warning.":::
161
162
162
163
Your secured IIS website is then displayed as in the following example:
0 commit comments