Skip to content

Commit 9236b18

Browse files
shawnmariejonesshawnmariejones
authored
Merge pull request #111842 from sebansal/docs-working-branch3
adding changes to certificate tutorials
2 parents 5100fc5 + 872f907 commit 9236b18

File tree

3 files changed

+176
-5
lines changed

3 files changed

+176
-5
lines changed

‎articles/key-vault/certificates/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@
2222
items:
2323
- name: Import a certificate
2424
href: tutorial-import-certificate.md
25+
- name: Configure certificate rotation
26+
href: tutorial-rotate-certificates.md
2527
- name: Concepts
2628
items:
2729
- name: Get started with Key Vault certificates

‎articles/key-vault/certificates/tutorial-import-certificate.md

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ms.service: key-vault
1010
ms.subservice: certificates
1111
ms.topic: tutorial
1212
ms.custom: mvc
13-
ms.date: 04/03/2020
13+
ms.date: 04/16/2020
1414
ms.author: sebansal
1515
#Customer intent:As a security admin who is new to Azure, I want to use Key Vault to securely store certificates in Azure
1616
---
@@ -72,18 +72,21 @@ To import a certificate to the vault, you need to have a PEM or PFX certificate
7272
- **Method of Certificate Creation**: Import.
7373
- **Certificate Name**: ExampleCertificate.
7474
- **Upload Certificate File**: select the certificate file from disk
75-
- Leave the other values to their defaults. Click **Create**.
75+
- **Password** : If you are uploading a password protected certificate file, provide that password here. Otherwise, leave it blank. Once the certificate file is successfully imported, key vault will remove that password.
76+
4. Click **Create**.
7677

7778
![Certificate properties](../media/certificates/tutorial-import-cert/cert-import.png)
7879

79-
Once that you receive the message that the certificate has been successfully imported, you may click on it on the list. You can then see some of its properties.
80+
By adding a certificate using **Import** method, Azure Key vault will automatically populate certificate parameters (i.e. validity period, Issuer name, activation date etc.).
81+
82+
Once you receive the message that the certificate has been successfully imported, you may click on it on the list to view its properties.
8083

8184
![Certificate properties](../media/certificates/tutorial-import-cert/current-version-hidden.png)
8285

8386
## Import a certificate using Azure CLI
8487

8588
Import a certificate into a specified key vault. To
86-
import an existing valid certificate, containing a private key, into Azure Key Vault, the file to be imported can be in either PFX or PEM format. If the certificate is in PEM format the PEM file must contain the key as well as x509 certificates. This operation requires the certificates/import permission.
89+
import an existing valid certificate, containing a private key, into Azure Key Vault, the file to be imported can be in either PFX or PEM format. If the certificate is in PEM format, the PEM file must contain the key as well as x509 certificates. This operation requires the certificates/import permission.
8790

8891
```azurecli
8992
az keyvault certificate import --file
@@ -98,6 +101,22 @@ az keyvault certificate import --file
98101
```
99102
Learn more about the parameters [here](https://docs.microsoft.com/cli/azure/keyvault/certificate?view=azure-cli-latest#az-keyvault-certificate-import)
100103

104+
After importing the certificate, you can view the certificate using [Certificate show](https://docs.microsoft.com/cli/azure/keyvault/certificate?view=azure-cli-latest#az-keyvault-certificate-show)
105+
106+
107+
```azurecli
108+
az keyvault certificate show [--id]
109+
[--name]
110+
[--only-show-errors]
111+
[--subscription]
112+
[--vault-name]
113+
[--version]
114+
```
115+
116+
117+
118+
Now, you have created a Key vault, imported a certificate and viewed Certificate's properties.
119+
101120
## Clean up resources
102121

103122
Other Key Vault quickstarts and tutorials build upon this quickstart. If you plan to continue on to work with subsequent quickstarts and tutorials, you may wish to leave these resources in place.
@@ -112,6 +131,6 @@ When no longer needed, delete the resource group, which deletes the Key Vault an
112131

113132
In this tutorial, you created a Key Vault and imported a certificate in it. To learn more about Key Vault and how to integrate it with your applications, continue on to the articles below.
114133

115-
- Read more about [Managing certificates in Azure Key Vault](/archive/blogs/kv/manage-certificates-via-azure-key-vault)
134+
- Read more about [Managing certificate creation in Azure Key Vault](https://docs.microsoft.com/azure/key-vault/certificates/create-certificate-scenarios)
116135
- See examples of [Importing Certificates Using REST APIs](/rest/api/keyvault/importcertificate/importcertificate)
117136
- Review [Azure Key Vault best practices](../general/best-practices.md)

‎articles/key-vault/certificates/tutorial-rotate-certificates.md

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
---
2+
title: Tutorial - Updating certificate's auto-rotation frequency in Key Vault | Microsoft Docs
3+
description: Tutorial showing how to update a certificate's auto-rotation frequency in Azure Key Vault using the Azure portal
4+
services: key-vault
5+
author: msmbaldwin
6+
manager: rkarlin
7+
tags: azure-resource-manager
8+
9+
ms.service: key-vault
10+
ms.subservice: certificates
11+
ms.topic: tutorial
12+
ms.custom: mvc
13+
ms.date: 04/16/2020
14+
ms.author: sebansal
15+
#Customer intent:As a security admin who is new to Azure, I want to use Key Vault to securely store certificates in Azure
16+
---
17+
# Tutorial: Configuring certificate's auto-rotation in Key Vault
18+
19+
Azure Key Vault lets you easily provision, manage, and deploy digital certificates. They could be public and private SSL/TLS certificates signed by Certificate Authority or a self-signed certificate. Key Vault can also request and renew certificates through partnerships with certificate authorities, providing a robust solution for certificate life cycle management. In this tutorial, you will update certificate's attributes - validity period, auto-rotation frequency, CA. For more information on Key Vault, review the [Overview](../general/overview.md).
20+
21+
The tutorial shows you how to:
22+
23+
> [!div class="checklist"]
24+
> * Manage a certificate using Azure portal
25+
> * Add Certificate Authority provider Account
26+
> * Update certificate's validity period
27+
> * Update certificate's auto-rotation frequency
28+
> * Update certificate's attributes using Azure Powershell
29+
30+
31+
Before you begin, read [Key Vault basic concepts](../general/basic-concepts.md).
32+
33+
If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
34+
35+
## Sign in to Azure
36+
37+
Sign in to the Azure portal at https://portal.azure.com.
38+
39+
## Create a vault
40+
41+
Create or select your existing Key Vault to perform operations. [(Steps to create a Key vault).](../quick-create-portal.md) In the example, the Vault name is **Example-Vault**.
42+
43+
![Output after Key Vault creation completes](../media/certificates/tutorial-import-cert/vault-properties.png)
44+
45+
## Create a certificate in Key Vault
46+
47+
Create or import a certificate in the vault. [(Steps to create certificate in Key vault).](../quick-create-portal.md) In this case, we work on certificate called **ExampleCertificate**.
48+
49+
> [!NOTE]
50+
> In Azure Key Vault, a certificate's life cycle attributes can be updated both at the time of certificate's creation as well as after it has been created.
51+
## Updating Certificate's life cycle attributes
52+
53+
A certificate created in the Key Vault can be
54+
- a self-signed certificate
55+
- a certificate created with a Certificate Authority (CA) that is partnered with Key Vault
56+
- a certificate with a Certificate Authority that is not partnered with Key Vault
57+
58+
The following Certificate Authorities are currently partnered providers with Key Vault:
59+
- DigiCert - Key Vault offers OV TLS/SSL certificates with DigiCert.
60+
- GlobalSign - Key Vault offers OV TLS/SSL certificates with GlobalSign.
61+
62+
Azure Key Vault auto-rotates certificates through partnerships with certificate authorities. Through that established partnership, Key Vault automatically requests and renews certificates. Therefore, **auto-rotation capability is not applicable for certificates created with CAs that are not partnered with Key Vault.**
63+
64+
> [!NOTE]
65+
> An account admin for a CA provider creates credentials to be used by Key Vault to create, renew, and use TLS/SSL certificates via Key Vault.
66+
![Certificate authority](../media/certificates/tutorial-rotate-cert/cert-authority-create.png)
67+
>
68+
69+
70+
### Updating Certificate's life cycle attributes at the time of Certificate creation
71+
72+
1. On the Key Vault properties pages, select **Certificates**.
73+
2. Click on **Generate/Import**.
74+
3. On the **Create a certificate** screen update the following values:
75+
76+
77+
- **Validity Period**: Enter the value (in months). Creating short lived certificates is a recommended security practice. By default validity value of a newly created certificate is 12 months.
78+
- **Lifetime Action Type**: Select certificate's auto-renewal and alerting action. As per the selection, update 'percentage lifetime' or 'Number of days before expiry'. By default, a certificate's auto-renewal is set at 80% of its lifetime.<br> From the drop down menu, select the option :
79+
80+
| Automatically renew at a given time| Email all contacts at a given time |
81+
|-----------|------|
82+
|Selecting this option will TURN ON autorotation | Selecting this option will NOT auto-rotate, it will only alert the contacts|
83+
84+
85+
86+
4. Click on **Create**.
87+
88+
![Certificate Life cycle](../media/certificates/tutorial-rotate-cert/create-cert-lifecycle.png)
89+
90+
### Updating Life cycle attributes of stored certificate
91+
92+
1. Select the Key Vault.
93+
2. On the Key Vault properties pages, select **Certificates**.
94+
3. Select the certificate that you wish to update. In this case, we will work on certificate called **ExampleCertificate**.
95+
4. Select **Issuance Policy** from the top menu bar.
96+
97+
![Certificate properties](../media/certificates/tutorial-rotate-cert/cert-issuance-policy.png)
98+
5. On the **Issuance Policy** screen, update the following values:
99+
- **Validity Period**: Update the value (in months)
100+
- **Lifetime Action Type**: Select certificate's auto-renewal and alerting action. As per the selection, update the 'percentage lifetime' or 'Number of days before expiry'.
101+
102+
![Certificate properties](../media/certificates/tutorial-rotate-cert/cert-policy-change.png)
103+
6. Click on **Save**.
104+
105+
> [!IMPORTANT]
106+
> Changing the Lifetime Action Type for a certificate will record modifications for the existing certificates immediately.
107+
108+
109+
### Updating Certificate's attributes using PowerShell
110+
111+
```azurepowershell
112+
113+
114+
Set-AzureKeyVaultCertificatePolicy -VaultName $vaultName
115+
-Name $certificateName
116+
-RenewAtNumberOfDaysBeforeExpiry [276 or appropriate calculated value]
117+
```
118+
119+
> [!TIP]
120+
> To modify renewal policy for a list of certificates, input​ File.csv​ containing
121+
> VaultName,CertName ​<br/>
122+
> vault1,Cert1​ <br/>
123+
> vault2,Cert2​
124+
>
125+
> ```azurepowershell
126+
> $file = Import-CSV C:\Users\myfolder\ReadCSVUsingPowershell\File.csv ​
127+
> foreach($line in $file)​
128+
> {​
129+
> Set-AzureKeyVaultCertificatePolicy -VaultName $vaultName -Name $certificateName -RenewAtNumberOfDaysBeforeExpiry [276 or appropriate calculated value]
130+
> }
131+
> ```
132+
>
133+
Learn more about the parameters [here](https://docs.microsoft.com/cli/azure/keyvault/certificate?view=azure-cli-latest#az-keyvault-certificate-set-attributes)
134+
135+
## Clean up resources
136+
137+
Other Key Vault quickstarts and tutorials build upon this quickstart. If you plan to continue on to work with subsequent quickstarts and tutorials, you may wish to leave these resources in place.
138+
When no longer needed, delete the resource group, which deletes the Key Vault and related resources. To delete the resource group through the portal:
139+
140+
1. Enter the name of your resource group in the Search box at the top of the portal. When you see the resource group used in this quickstart in the search results, select it.
141+
2. Select **Delete resource group**.
142+
3. In the **TYPE THE RESOURCE GROUP NAME:** box type in the name of the resource group and select **Delete**.
143+
144+
145+
## Next steps
146+
147+
In this tutorial, you updated a certificate's life-cycle. To learn more about Key Vault and how to integrate it with your applications, continue on to the articles below.
148+
149+
Read more about [Managing certificate creation in Azure Key Vault](https://docs.microsoft.com/azure/key-vault/certificates/create-certificate-scenarios)
150+
- Review the [Key Vault Overview](../general/overview.md)

0 commit comments

Comments
 (0)