Skip to content

Create a Microsoft Azure Application Gateway machine

Create a Microsoft Azure Application Gateway machine so Certificate Manager - SaaS can discover the Secure Sockets Layer (SSL) certificates on the Application Gateways in an Azure subscription and provision certificates to their HTTPS listeners. The connector runs in the cloud and signs in to Azure as a Microsoft Entra ID service principal, so no VSatellite is needed.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • An Azure subscription that contains the Application Gateways, and its subscription ID.
  • A Microsoft Entra ID service principal that authenticates with a client secret, and its tenant ID, application (client) ID, and client secret.

  • The Network Contributor role assigned to the service principal on the subscription or on the resource group that contains the Application Gateways. This role grants the read and write permissions on Microsoft.Network/applicationGateways that the connector needs. Discovery needs read access to the gateways, and provisioning needs write access.

    Tip

    To create the service principal in the Azure portal, select Microsoft Entra ID > App registrations > New registration, and record the application (client) ID. Then select Certificates & secrets > New client secret, and record the secret value, which Azure shows only once. To assign the role, select Subscriptions > your subscription > Access control (IAM) > Add role assignment.

To create a Microsoft Azure Application Gateway machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Azure Application Gateway.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.
  6. In Tenant ID, enter the ID of the Microsoft Entra ID tenant that holds the service principal.
  7. In Client ID, enter the application (client) ID of the service principal.

  8. In Client Secret, enter the client secret of the service principal.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  9. In Subscription ID, enter the ID of the Azure subscription that contains the Application Gateways.

    Note

    Tenant ID, Client ID, and Subscription ID must each be a universally unique identifier (UUID): 32 hexadecimal characters with four hyphens.

  10. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that the service principal can sign in and list the Application Gateways in the subscription. A subscription with no Application Gateways still passes. The test doesn't confirm that the service principal has write access, which provisioning needs.

  11. (Optional) In Resource Group, enter the name of a resource group to discover only the Application Gateways in it. If you leave it empty, discovery searches every resource group in the subscription.

    Note

    This Resource Group setting applies only to discovery. When you provision a certificate, you enter the target gateway's resource group again in the provisioning dialog, where it's required.

  12. (Optional) To skip certificates that have already expired, enable Exclude Expired Certificates.

    Discovery finds only the uploaded SSL certificates that are bound to at least one HTTPS listener. It skips certificates that the gateway loads from Microsoft Azure Key Vault, and certificates that no HTTPS listener uses.

  13. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  14. Click Continue. The Provisioning step opens.

  15. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  16. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates on your Application Gateways.