Skip to content

Commit a1867f5

Browse files
sethmanheimsethmanheim
committed
Reviews
1 parent df84724 commit a1867f5

File tree

2 files changed

+145
-152
lines changed

2 files changed

+145
-152
lines changed

‎azure-stack/operator/azure-stack-prepare-pki-certs.md

Lines changed: 121 additions & 121 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
---
22
title: Prepare Azure Stack Hub PKI certificates for deployment or rotation
3-
titleSuffix: Azure Stack Hub
43
description: Learn how to prepare PKI certificates for Azure Stack Hub deployment or for rotating secrets.
54
author: sethmanheim
65
ms.topic: how-to
7-
ms.date: 10/19/2020
6+
ms.date: 01/30/2025
87
ms.author: sethm
9-
ms.reviewer: ppacent
108
ms.lastreviewed: 10/19/2020
119

1210
# Intent: As an Azure Stack operator, I want to prepare my PKI certificates for Azure Stack deployment.
@@ -18,13 +16,14 @@ ms.lastreviewed: 10/19/2020
1816
# Prepare Azure Stack Hub PKI certificates for deployment or rotation
1917

2018
> [!NOTE]
21-
> This article pertains to the preparation of external certificates only, which are used to secure endpoints on external infrastructure and services. Internal certificates are managed separately, during the [certificate rotation process](azure-stack-rotate-secrets.md).
19+
> This article only describes the preparation of external certificates, which are used to secure endpoints on external infrastructure and services. Internal certificates are managed separately, during the [certificate rotation process](azure-stack-rotate-secrets.md).
20+
2221
> [!NOTE]
2322
> If you are installing Azure Container Registry (ACR), we recommend aligning the expiration dates of your external ACR certificates with the expiration dates of your other external Azure Stack Hub certificates. Additionally, we recommend protecting your PFX for ACR with the same password that you use to protect your other external certificate PFXs.
2423
2524
The certificate files [obtained from the certificate authority (CA)](azure-stack-get-pki-certs.md) must be imported and exported with properties matching Azure Stack Hub's certificate requirements.
2625

27-
In this article you learn how to import, package, and validate external certificates, to prepare for Azure Stack Hub deployment or secrets rotation.
26+
In this article, you learn how to import, package, and validate external certificates, to prepare for Azure Stack Hub deployment or secrets rotation.
2827

2928
## Prerequisites
3029

@@ -43,113 +42,119 @@ Use these steps to package certificates using the Azure Stack readiness checker
4342

4443
1. Install the Azure Stack readiness checker module from a PowerShell prompt (5.1 or above), by running the following cmdlet:
4544

46-
```powershell
47-
Install-Module Microsoft.AzureStack.ReadinessChecker -Force -AllowPrerelease
48-
```
49-
2. Specify the **Path** to the certificate files. For example:
50-
51-
```powershell
52-
$Path = "$env:USERPROFILE\Documents\AzureStack"
53-
```
54-
55-
3. Declare the **pfxPassword**. For example:
56-
57-
```powershell
58-
$pfxPassword = Read-Host -AsSecureString -Prompt "PFX Password"
59-
```
60-
4. Declare the **ExportPath** where the resulting PFXs will be exported to. For example:
61-
62-
```powershell
63-
$ExportPath = "$env:USERPROFILE\Documents\AzureStack"
64-
```
65-
66-
5. Convert certificates to Azure Stack Hub Certificates. For example:
67-
68-
```powershell
69-
ConvertTo-AzsPFX -Path $Path -pfxPassword $pfxPassword -ExportPath $ExportPath
70-
```
71-
8. Review the output:
72-
73-
```powershell
74-
ConvertTo-AzsPFX v1.2005.1286.272 started.
75-
76-
Stage 1: Scanning Certificates
77-
Path: C:\Users\[*redacted*]\Documents\AzureStack Filter: CER Certificate count: 11
78-
adminmanagement_east_azurestack_contoso_com_CertRequest_20200710235648.cer
79-
adminportal_east_azurestack_contoso_com_CertRequest_20200710235645.cer
80-
management_east_azurestack_contoso_com_CertRequest_20200710235644.cer
81-
portal_east_azurestack_contoso_com_CertRequest_20200710235646.cer
82-
wildcard_adminhosting_east_azurestack_contoso_com_CertRequest_20200710235649.cer
83-
wildcard_adminvault_east_azurestack_contoso_com_CertRequest_20200710235642.cer
84-
wildcard_blob_east_azurestack_contoso_com_CertRequest_20200710235653.cer
85-
wildcard_hosting_east_azurestack_contoso_com_CertRequest_20200710235652.cer
86-
wildcard_queue_east_azurestack_contoso_com_CertRequest_20200710235654.cer
87-
wildcard_table_east_azurestack_contoso_com_CertRequest_20200710235650.cer
88-
wildcard_vault_east_azurestack_contoso_com_CertRequest_20200710235647.cer
89-
90-
Detected ExternalFQDN: east.azurestack.contoso.com
91-
92-
Stage 2: Exporting Certificates
93-
east.azurestack.contoso.com\Deployment\ARM Admin\ARMAdmin.pfx
94-
east.azurestack.contoso.com\Deployment\Admin Portal\AdminPortal.pfx
95-
east.azurestack.contoso.com\Deployment\ARM Public\ARMPublic.pfx
96-
east.azurestack.contoso.com\Deployment\Public Portal\PublicPortal.pfx
97-
east.azurestack.contoso.com\Deployment\Admin Extension Host\AdminExtensionHost.pfx
98-
east.azurestack.contoso.com\Deployment\KeyVaultInternal\KeyVaultInternal.pfx
99-
east.azurestack.contoso.com\Deployment\ACSBlob\ACSBlob.pfx
100-
east.azurestack.contoso.com\Deployment\Public Extension Host\PublicExtensionHost.pfx
101-
east.azurestack.contoso.com\Deployment\ACSQueue\ACSQueue.pfx
102-
east.azurestack.contoso.com\Deployment\ACSTable\ACSTable.pfx
103-
east.azurestack.contoso.com\Deployment\KeyVault\KeyVault.pfx
104-
105-
Stage 3: Validating Certificates.
106-
107-
Validating east.azurestack.contoso.com-Deployment-AAD certificates in C:\Users\[*redacted*]\Documents\AzureStack\east.azurestack.contoso.com\Deployment
108-
109-
Testing: KeyVaultInternal\KeyVaultInternal.pfx
110-
Thumbprint: E86699****************************4617D6
111-
PFX Encryption: OK
112-
Expiry Date: OK
113-
Signature Algorithm: OK
114-
DNS Names: OK
115-
Key Usage: OK
116-
Key Length: OK
117-
Parse PFX: OK
118-
Private Key: OK
119-
Cert Chain: OK
120-
Chain Order: OK
121-
Other Certificates: OK
122-
Testing: ARM Public\ARMPublic.pfx
123-
...
124-
Log location (contains PII): C:\Users\[*redacted*]\AppData\Local\Temp\AzsReadinessChecker\AzsReadinessChecker.log
125-
ConvertTo-AzsPFX Completed
126-
```
127-
> [!NOTE]
128-
> For additional usage use Get-help ConvertTo-AzsPFX -Full for further usage such as disabling validation or filtering for different certificate formats.
129-
130-
Following a successful validation certificates can be presented for Deployment or Rotation without any additional steps.
45+
```powershell
46+
Install-Module Microsoft.AzureStack.ReadinessChecker -Force -AllowPrerelease
47+
```
48+
49+
1. Specify the **Path** to the certificate files. For example:
50+
51+
```powershell
52+
$Path = "$env:USERPROFILE\Documents\AzureStack"
53+
```
54+
55+
1. Declare the **pfxPassword**. For example:
56+
57+
```powershell
58+
$pfxPassword = Read-Host -AsSecureString -Prompt "PFX Password"
59+
```
60+
61+
1. Declare the **ExportPath** where the resulting PFXs will be exported to. For example:
62+
63+
```powershell
64+
$ExportPath = "$env:USERPROFILE\Documents\AzureStack"
65+
```
66+
67+
1. Convert certificates to Azure Stack Hub Certificates. For example:
68+
69+
```powershell
70+
ConvertTo-AzsPFX -Path $Path -pfxPassword $pfxPassword -ExportPath $ExportPath
71+
```
72+
73+
1. Review the output:
74+
75+
```powershell
76+
ConvertTo-AzsPFX v1.2005.1286.272 started.
77+
```
78+
79+
```output
80+
Stage 1: Scanning Certificates
81+
Path: C:\Users\[*redacted*]\Documents\AzureStack Filter: CER Certificate count: 11
82+
adminmanagement_east_azurestack_contoso_com_CertRequest_20200710235648.cer
83+
adminportal_east_azurestack_contoso_com_CertRequest_20200710235645.cer
84+
management_east_azurestack_contoso_com_CertRequest_20200710235644.cer
85+
portal_east_azurestack_contoso_com_CertRequest_20200710235646.cer
86+
wildcard_adminhosting_east_azurestack_contoso_com_CertRequest_20200710235649.cer
87+
wildcard_adminvault_east_azurestack_contoso_com_CertRequest_20200710235642.cer
88+
wildcard_blob_east_azurestack_contoso_com_CertRequest_20200710235653.cer
89+
wildcard_hosting_east_azurestack_contoso_com_CertRequest_20200710235652.cer
90+
wildcard_queue_east_azurestack_contoso_com_CertRequest_20200710235654.cer
91+
wildcard_table_east_azurestack_contoso_com_CertRequest_20200710235650.cer
92+
wildcard_vault_east_azurestack_contoso_com_CertRequest_20200710235647.cer
93+
94+
Detected ExternalFQDN: east.azurestack.contoso.com
95+
96+
Stage 2: Exporting Certificates
97+
east.azurestack.contoso.com\Deployment\ARM Admin\ARMAdmin.pfx
98+
east.azurestack.contoso.com\Deployment\Admin Portal\AdminPortal.pfx
99+
east.azurestack.contoso.com\Deployment\ARM Public\ARMPublic.pfx
100+
east.azurestack.contoso.com\Deployment\Public Portal\PublicPortal.pfx
101+
east.azurestack.contoso.com\Deployment\Admin Extension Host\AdminExtensionHost.pfx
102+
east.azurestack.contoso.com\Deployment\KeyVaultInternal\KeyVaultInternal.pfx
103+
east.azurestack.contoso.com\Deployment\ACSBlob\ACSBlob.pfx
104+
east.azurestack.contoso.com\Deployment\Public Extension Host\PublicExtensionHost.pfx
105+
east.azurestack.contoso.com\Deployment\ACSQueue\ACSQueue.pfx
106+
east.azurestack.contoso.com\Deployment\ACSTable\ACSTable.pfx
107+
east.azurestack.contoso.com\Deployment\KeyVault\KeyVault.pfx
108+
109+
Stage 3: Validating Certificates.
110+
111+
Validating east.azurestack.contoso.com-Deployment-AAD certificates in C:\Users\[*redacted*]\Documents\AzureStack\east.azurestack.contoso.com\Deployment
112+
113+
Testing: KeyVaultInternal\KeyVaultInternal.pfx
114+
Thumbprint: E86699****************************4617D6
115+
PFX Encryption: OK
116+
Expiry Date: OK
117+
Signature Algorithm: OK
118+
DNS Names: OK
119+
Key Usage: OK
120+
Key Length: OK
121+
Parse PFX: OK
122+
Private Key: OK
123+
Cert Chain: OK
124+
Chain Order: OK
125+
Other Certificates: OK
126+
Testing: ARM Public\ARMPublic.pfx
127+
...
128+
Log location (contains PII): C:\Users\[*redacted*]\AppData\Local\Temp\AzsReadinessChecker\AzsReadinessChecker.log
129+
ConvertTo-AzsPFX Completed
130+
```
131+
132+
> [!NOTE]
133+
> Use `Get-help ConvertTo-AzsPFX -Full` to see further options, such as disabling validation or filtering for different certificate formats.
134+
135+
Following a successful validation, certificates can be presented for deployment or rotation without any additional steps.
131136

132137
## Prepare certificates (manual steps)
133138

134-
Use these steps to package certificates for new Azure Stack Hub PKI certificates using manual steps.
139+
You can use these manual steps to package certificates for new Azure Stack Hub PKI certificates.
135140

136141
### Import the certificate
137142

138-
1. Copy the original certificate versions [obtained from your CA of choice](azure-stack-get-pki-certs.md) into a directory on the deployment host.
139-
> [!WARNING]
140-
> Don't copy files that have already been imported, exported, or altered in any way from the files provided directly by the CA.
143+
1. Copy the original certificate versions [obtained from your CA of choice](azure-stack-get-pki-certs.md) into a directory on the deployment host.
141144

142-
1. Right-click on the certificate and select **Install Certificate** or **Install PFX**, depending on how the certificate was delivered from your CA.
145+
> [!WARNING]
146+
> Don't copy files that were already imported, exported, or altered in any way from the files provided directly by the CA.
143147
148+
1. Right-click the certificate and select **Install Certificate** or **Install PFX**, depending on how the certificate was delivered from your CA.
144149
1. In the **Certificate Import Wizard**, select **Local Machine** as the import location. Select **Next**. On the following screen, select next again.
145150

146-
![Local machine import location for certificate](./media/prepare-pki-certs/1.png)
151+
![Local machine import location for certificate](./media/prepare-pki-certs/1.png)
147152

148-
1. Choose **Place all certificate in the following store** and then select **Enterprise Trust** as the location. Select **OK** to close the certificate store selection dialog box and then select **Next**.
153+
1. Select **Place all certificate in the following store** and then select **Enterprise Trust** as the location. Select **OK** to close the certificate store selection dialog box and then select **Next**.
149154

150155
![Configure the certificate store for certificate import](./media/prepare-pki-certs/3.png)
151156

152-
a. If you're importing a PFX, you'll be presented with an additional dialog. On the **Private key protection** page, enter the password for your certificate files and then enable the **Mark this key as exportable.** option, allowing you to back up or transport your keys later. Select **Next**.
157+
1. If you import a PFX, you're presented with an additional dialog. On the **Private key protection** page, enter the password for your certificate files and then enable the **Mark this key as exportable.** option, allowing you to back up or transport your keys later. Select **Next**.
153158

154159
![Mark key as exportable](./media/prepare-pki-certs/2.png)
155160

@@ -160,48 +165,43 @@ Use these steps to package certificates for new Azure Stack Hub PKI certificates
160165
161166
### Export the certificate
162167

163-
Open Certificate Manager MMC console and connect to the Local Machine certificate store.
168+
Open Certificate Manager MMC console and connect to the local machine certificate store.
164169

165170
1. Open the Microsoft Management Console. To open the console in Windows 10, right-click on the **Start Menu**, select **Run**, then type **mmc** and press enter.
171+
1. Select **File** > **Add/Remove Snap-In**, then select **Certificates** and select **Add**.
166172

167-
2. Select **File** > **Add/Remove Snap-In**, then select **Certificates** and select **Add**.
168-
169-
![Add Certificates Snap-in in Microsoft Management Console](./media/prepare-pki-certs/mmc-2.png)
173+
![Add Certificates Snap-in in Microsoft Management Console](./media/prepare-pki-certs/mmc-2.png)
170174

171-
3. Select **Computer account**, then select **Next**. Select **Local computer** and then **Finish**. Select **OK** to close the Add/Remove Snap-In page.
175+
1. Select **Computer account**, then select **Next**. Select **Local computer** and then **Finish**. Select **OK** to close the Add/Remove Snap-In page.
172176

173-
![Select account for Add Certificates Snap-in in Microsoft Management Console](./media/prepare-pki-certs/mmc-3.png)
177+
![Select account for Add Certificates Snap-in in Microsoft Management Console](./media/prepare-pki-certs/mmc-3.png)
174178

175-
4. Browse to **Certificates** > **Enterprise Trust** > **Certificate location**. Verify that you see your certificate on the right.
176-
177-
5. From the Certificate Manager Console taskbar, select **Actions** > **All Tasks** > **Export**. Select **Next**.
179+
1. Browse to **Certificates** > **Enterprise Trust** > **Certificate location**. Verify that you see your certificate on the right.
180+
1. From the Certificate Manager Console taskbar, select **Actions** > **All Tasks** > **Export**. Select **Next**.
178181

179182
> [!NOTE]
180-
> Depending on how many Azure Stack Hub certificates you have, you may need to complete this process more than once.
183+
> Depending on how many Azure Stack Hub certificates you have, you might need to complete this process more than once.
181184
182-
6. Select **Yes, Export the Private Key**, and then select **Next**.
185+
1. Select **Yes, Export the Private Key**, and then select **Next**.
186+
1. In the Export File Format section:
183187

184-
7. In the Export File Format section:
185-
186188
- Select **Include all certificates in the certificate if possible**.
187189
- Select **Export all Extended Properties**.
188190
- Select **Enable certificate privacy**.
189191
- Select **Next**.
190-
191-
![Certificate export wizard with selected options](./media/prepare-pki-certs/azure-stack-save-cert.png)
192-
193-
8. Select **Password** and provide a password for the certificates. Create a password that meets the following password complexity requirements:
194192

195-
* A minimum length of eight characters.
196-
* At least three of the following characters: uppercase letter, lowercase letter, numbers from 0-9, special characters, alphabetical character that's not uppercase or lowercase.
193+
![Certificate export wizard with selected options](./media/prepare-pki-certs/azure-stack-save-cert.png)
197194

198-
Make note of this password. You'll use it as a deployment parameter.
195+
1. Select **Password** and provide a password for the certificates. Create a password that meets the following password complexity requirements:
199196

200-
9. Select **Next**.
197+
- A minimum length of eight characters.
198+
- At least three of the following characters: uppercase letter, lowercase letter, numbers from 0-9, special characters, alphabetical character that's not uppercase or lowercase.
201199

202-
10. Choose a file name and location for the PFX file to export. Select **Next**.
200+
Make a note of this password. You use it later as a deployment parameter.
203201

204-
11. Select **Finish**.
202+
1. Select **Next**.
203+
1. Choose a file name and location for the PFX file to export. Select **Next**.
204+
1. Select **Finish**.
205205

206206
## Next steps
207207

0 commit comments

Comments
 (0)