Skip to content

Provision certificates to Microsoft Azure Private Key Vault

Provision a certificate from Certificate Manager - SaaS to a Microsoft Azure Key Vault. Certificate Manager - SaaS imports the certificate, its private key, and its issuing chain into the key vault under the name you choose.

Before you begin

  • A Microsoft Azure Key Vault machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • Permission for the machine's app registration to import certificates into the key vault.

To provision a certificate to Microsoft Azure Private Key Vault

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, in Certificate Name, enter the name for the certificate in the key vault. Use only letters, digits, and hyphens.

    If a certificate with that name already exists in the key vault, Certificate Manager - SaaS doesn't fail. It adds the certificate as a new version of the existing certificate, which becomes the current version. This is how renewals replace a certificate in the key vault.

  6. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.

  7. Click Save. To save and then provision another certificate, click Save & New.

After you save, an installation appears on the machine's Installations tab. When the certificate is pushed, Certificate Manager - SaaS imports it into the key vault in Privacy-Enhanced Mail (PEM) format. To provision on a schedule instead of right away, set up a machine provisioning schedule.