You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The following examples require an object named "mydigicert" to already be available in your key vault with the issuer provider as DigiCert. The certificate issuer is an entity represented in Azure Key Vault (KV) as a CertificateIssuer resource. It is used to provide information about the source of a KV certificate; issuer name, provider, credentials, and other administrative details.
39
+
The following examples require an object named "mydigicert" to already be available in your key vault with the issuer provider as DigiCert. The certificate issuer is an entity represented in Azure Key Vault (KV) as a CertificateIssuer resource. It's used to provide information about the source of a KV certificate; issuer name, provider, credentials, and other administrative details.
## Merge when pending request is created with an issuer
255
-
Merge is not allowed when a pending object is created with an issuer but is allowed when its state is "inProgress."
255
+
Merge isn't allowed when a pending object is created with an issuer but is allowed when its state is `inProgress`.
256
256
257
257
If the request to create the x509 certificate fails or cancels for some reason, and if an x509 certificate can be retrieved by out-of-band means, a merge operation can be done to complete the KV certificate.
## Request a cancellation while the pending request status is "inProgress"
286
-
A cancellation can only be requested. A request may or may not be canceled. If a request is not "inProgress", an http status of 400 (Bad Request) is returned.
286
+
A cancellation can only be requested. A request may or may not be canceled. If a request isn't "inProgress", an http status of 400 (Bad Request) is returned.
You can create a certificate issued with a CA of your choice through a manual creation process. Set the name of the issuer to “Unknown” or do not specify the issuer field.
356
+
You can create a certificate issued with a CA of your choice through a manual creation process. Set the name of the issuer to “Unknown” or don't specify the issuer field.
Copy file name to clipboardExpand all lines: articles/key-vault/certificates/create-certificate.md
+11-10Lines changed: 11 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,44 +15,45 @@ ms.author: mbaldwin
15
15
16
16
# Certificate creation methods
17
17
18
-
A Key Vault (KV) certificate can be either created or imported into a key vault. When a KV certificate is created the private key is created inside the key vault and never exposed to certificate owner. The following are ways to create a certificate in Key Vault:
18
+
A Key Vault (KV) certificate can be either created or imported into a key vault. When a KV certificate is created, the private key is created inside the key vault and never exposed to certificate owner. The following are ways to create a certificate in Key Vault:
19
19
20
-
-**Create a self-signed certificate:**This will create a public-private key pair and associate it with a certificate. The certificate will be signed by its own key.
20
+
-**Create a self-signed certificate:**Create a public-private key pair and associate it with a certificate. The certificate will be signed by its own key.
21
21
22
-
-**Create a new certificate manually:**This will create a public-private key pair and generate an X.509 certificate signing request. The signing request can be signed by your registration authority or certification authority. The signed x509 certificate can be merged with the pending key pair to complete the KV certificate in Key Vault. Although this method requires more steps, it does provide you with greater security because the private key is created in and restricted to Key Vault. This is explained in the diagram below.
22
+
-**Create a new certificate manually:**Create a public-private key pair and generate an X.509 certificate signing request. The signing request can be signed by your registration authority or certification authority. The signed x509 certificate can be merged with the pending key pair to complete the KV certificate in Key Vault. Although this method requires more steps, it does provide you with greater security because the private key is created in and restricted to Key Vault.
23
23
24
24
25
25
26
26
The following descriptions correspond to the green lettered steps in the preceding diagram.
27
27
28
-
1. In the diagram above, your application is creating a certificate which internally begins by creating a key in your key vault.
28
+
1. In the diagram, your application is creating a certificate, which internally begins by creating a key in your key vault.
29
29
2. Key Vault returns to your application a Certificate Signing Request (CSR)
30
30
3. Your application passes the CSR to your chosen CA.
31
31
4. Your chosen CA responds with an X509 Certificate.
32
32
5. Your application completes the new certificate creation with a merger of the X509 Certificate from your CA.
33
33
34
-
-**Create a certificate with a known issuer provider:** This method requires you to do a one-time task of creating an issuer object. Once an issuer object is created in you key vault, its name can be referenced in the policy of the KV certificate. A request to create such a KV certificate will create a key pair in the vault and communicate with the issuer provider service using the information in the referenced issuer object to get an x509 certificate. The x509 certificate is retrieved from the issuer service and is merged with the key pair to complete the KV certificate creation.
34
+
-**Create a certificate with a known issuer provider:** This method requires you to do a one-time task of creating an issuer object. Once an issuer object is created in you key vault, its name can be referenced in the policy of the KV certificate. A request to create such a KV certificate will create a key pair in the vault and communicate with the issuer provider service using the information in the referenced issuer object to get an x509 certificate. The x509 certificate is retrieved from the issuer service and is merged with the key pair to complete the KV certificate creation.
35
35
36
36
37
37
38
38
The following descriptions correspond to the green lettered steps in the preceding diagram.
39
39
40
-
1. In the diagram above, your application is creating a certificate which internally begins by creating a key in your key vault.
40
+
1. In the diagram, your application is creating a certificate, which internally begins by creating a key in your key vault.
41
41
2. Key Vault sends an TLS/SSL Certificate Request to the CA.
42
42
3. Your application polls, in a loop and wait process, for your Key Vault for certificate completion. The certificate creation is complete when Key Vault receives the CA’s response with x509 certificate.
43
43
4. The CA responds to Key Vault's TLS/SSL Certificate Request with an TLS/SSL X.509 certificate.
44
44
5. Your new certificate creation completes with the merger of the TLS/SSL X.509 certificate for the CA.
45
45
46
46
## Asynchronous process
47
+
47
48
KV certificate creation is an asynchronous process. This operation will create a KV certificate request and return an http status code of 202 (Accepted). The status of the request can be tracked by polling the pending object created by this operation. The full URI of the pending object is returned in the LOCATION header.
48
49
49
50
When a request to create a KV certificate completes, the status of the pending object will change to "completed" from "in progress", and a new version of the KV certificate will be created. This will become the current version.
50
51
51
52
## First creation
52
-
When a KV certificate is created for the first time, an addressable key and secret is also created with the same name as that of the certificate. If the name is already in use, then the operation will fail with an http status code of 409 (conflict).
53
+
When a KV certificate is created for the first time, an addressable key and secret is also created with the same name as the certificate. If the name is already in use, then the operation will fail with an http status code of 409 (conflict).
53
54
The addressable key and secret get their attributes from the KV certificate attributes. The addressable key and secret created this way are marked as managed keys and secrets, whose lifetime is managed by Key Vault. Managed keys and secrets are read-only. Note: If a KV certificate expires or is disabled, the corresponding key and secret will become inoperable.
54
55
55
-
If this is the first operation to create a KV certificate then a policy is required. A policy can also be supplied with successive create operations to replace the policy resource. If a policy is not supplied, then the policy resource on the service is used to create a next version of KV certificate. Note that while a request to create a next version is in progress, the current KV certificate, and corresponding addressable key and secret, remain unchanged.
56
+
If this is the first operation to create a KV certificate, a policy is required. A policy can also be supplied with successive create operations to replace the policy resource. If a policy isn't supplied, then the policy resource on the service is used to create a next version of KV certificate. While a request to create a next version is in progress, the current KV certificate, and corresponding addressable key and secret, remain unchanged.
56
57
57
58
## Self-issued certificate
58
59
To create a self-issued certificate, set the issuer name as "Self" in the certificate policy as shown in following snippet from certificate policy.
@@ -64,7 +65,7 @@ When a request to create a KV certificate completes, the status of the pending o
64
65
65
66
```
66
67
67
-
If the issuer name is not specified, then the issuer name is set to "Unknown". When issuer is "Unknown", the certificate owner will have to manually get a x509 certificate from the issuer of his/her choice, then merge the public x509 certificate with the key vault certificate pending object to complete the certificate creation.
68
+
If the issuer name isn't specified, then the issuer name is set to "Unknown". When issuer is "Unknown", the certificate owner will have to manually get a x509 certificate from the issuer of their choice, then merge the public x509 certificate with the key vault certificate pending object to complete the certificate creation.
68
69
69
70
```
70
71
"issuer": {
@@ -83,7 +84,7 @@ Certificate creation can be completed manually or using a "Self" issuer. Key Vau
83
84
84
85
A certificate issuer is an entity represented in Azure Key Vault (KV) as a CertificateIssuer resource. It is used to provide information about the source of a KV certificate; issuer name, provider, credentials, and other administrative details.
85
86
86
-
Note that when an order is placed with the issuer provider, it may honor or override the x509 certificate extensions and certificate validity period based on the type of certificate.
87
+
When an order is placed with the issuer provider, it may honor or override the x509 certificate extensions and certificate validity period based on the type of certificate.
87
88
88
89
Authorization: Requires the certificates/create permission.
Copy file name to clipboardExpand all lines: articles/key-vault/certificates/overview-renew-certificate.md
+18-15Lines changed: 18 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,8 +8,8 @@ tags: azure-resource-manager
8
8
ms.service: key-vault
9
9
ms.subservice: certificates
10
10
ms.topic: overview
11
-
ms.date: 07/20/2020
12
-
ms.author: sebansal
11
+
ms.date: 01/20/2023
12
+
ms.author: mbaldwin
13
13
---
14
14
15
15
# Renew your Azure Key Vault certificates
@@ -23,40 +23,43 @@ This article discusses how to renew your Azure Key Vault certificates.
23
23
## Get notified about certificate expiration
24
24
To get notified about certificate life events, you would need to add certificate contact. Certificate contacts contain contact information to send notifications triggered by certificate lifetime events. The contacts information is shared by all the certificates in the key vault. A notification is sent to all the specified contacts for an event for any certificate in the key vault.
25
25
26
-
### Steps to set certificate notifications:
26
+
### Steps to set certificate notifications
27
+
27
28
First, add a certificate contact to your key vault. You can add using the Azure portal or the PowerShell cmdlet [Add-AzKeyVaultCertificateContact](/powershell/module/az.keyvault/add-azkeyvaultcertificatecontact).
28
29
29
30
Second, configure when you want to be notified about the certificate expiration. To configure the lifecycle attributes of the certificate, see [Configure certificate autorotation in Key Vault](./tutorial-rotate-certificates.md#update-lifecycle-attributes-of-a-stored-certificate).
30
31
31
-
If a certificate's policy is set to auto renewal, then a notification is sent on the following events.
32
+
If a certificate's policy is set to auto renewal, then a notification is sent on the following events:
32
33
33
34
- Before certificate renewal
34
35
- After certificate renewal, stating if the certificate was successfully renewed, or if there was an error, requiring manual renewal of the certificate.
35
36
36
-
When a certificate policy that is set to be manually renewed (email only), a notification is sent when it's time to renew the certificate.
37
+
When a certificate policy is set to be manually renewed (email only), a notification is sent when it's time to renew the certificate.
37
38
38
39
In Key Vault, there are three categories of certificates:
39
-
- Certificates that are created with an integrated certificate authority (CA), such as DigiCert or GlobalSign
40
-
- Certificates that are created with a nonintegrated CA
41
-
- Self-signed certificates
40
+
- Certificates that are created with an integrated certificate authority (CA), such as DigiCert or GlobalSign.
41
+
- Certificates that are created with a nonintegrated CA.
42
+
- Self-signed certificates.
43
+
44
+
## Renew an integrated CA certificate
45
+
46
+
Azure Key Vault handles the end-to-end maintenance of certificates that are issued by trusted Microsoft certificate authorities DigiCert and GlobalSign. Learn how to [integrate a trusted CA with Key Vault](./how-to-integrate-certificate-authority.md). When a certificate is renewed, a new secret version is created with a new Key Vault identifier.
42
47
43
-
## Renew an integrated CA certificate
44
-
Azure Key Vault handles the end-to-end maintenance of certificates that are issued by trusted Microsoft certificate authorities DigiCert and GlobalSign. Learn how to [integrate a trusted CA with Key Vault](./how-to-integrate-certificate-authority.md). When a certificate is renewed a new secret version is created with a new Key Vault identifier.
48
+
## Renew a nonintegrated CA certificate
45
49
46
-
## Renew a nonintegrated CA certificate
47
50
By using Azure Key Vault, you can import certificates from any CA, a benefit that lets you integrate with several Azure resources and make deployment easy. If you're worried about losing track of your certificate expiration dates or, worse, you've discovered that a certificate has already expired, your key vault can help keep you up to date. For nonintegrated CA certificates, the key vault lets you set up near-expiration email notifications. Such notifications can be set for multiple users as well.
48
51
49
52
> [!IMPORTANT]
50
53
> A certificate is a versioned object. If the current version is expiring, you need to create a new version. Conceptually, each new version is a new certificate that's composed of a key and a blob that ties that key to an identity. When you use a nonpartnered CA, the key vault generates a key/value pair and returns a certificate signing request (CSR).
51
54
52
-
To renew a nonintegrated CA certificate, do the following:
55
+
To renew a nonintegrated CA certificate:
53
56
54
57
1. Sign in to the Azure portal, and then open the certificate you want to renew.
55
58
1. On the certificate pane, select **New Version**.
56
-
3. On the **Create a certificate** page make sure the **Generate** option is selected under **Method of Certificate Creation**.
57
-
4. Verify the **Subject** and other details about the certificate and then click**Create**.
59
+
3. On the **Create a certificate** page, make sure the **Generate** option is selected under **Method of Certificate Creation**.
60
+
4. Verify the **Subject** and other details about the certificate and then select**Create**.
58
61
5. You should now see the message **The creation of certificate << certificate name >> is currently pending. Click here to go its Certificate Operation to monitor the progress**
59
-
6. Click on the message and a new pane should be shown. The pane should show the status as "In Progress". At this point key vault has generated a CSR that you can download using the **Download CSR** option.
62
+
1. Select on the message and a new pane should be shown. The pane should show the status as "In Progress". At this point, Key Vault has generated a CSR that you can download using the **Download CSR** option.
60
63
1. Select **Download CSR** to download a CSR file to your local drive.
61
64
1. Send the CSR to your choice of CA to sign the request.
62
65
1. Bring back the signed request, and select **Merge Signed Request** on the same certificate operation pane.
0 commit comments