You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/key-vault/certificates/certificate-scenarios.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,7 +47,7 @@ Before a certificate can be created in Key Vault, the following prerequisite ste
47
47
- Provider
48
48
- Credentials – CA account credentials. Each CA has its own specific data.
49
49
50
-
For more information on creating accounts with CA Providers, see [Integrating Key Vault with certificate authorities](./how-to-integrate-certificate-authority.md).
50
+
For more information on creating accounts with CA providers, see [Integrating Key Vault with certificate authorities](./how-to-integrate-certificate-authority.md).
51
51
52
52
**Step 3b:** Set up [certificate contacts](/rest/api/keyvault/certificates/set-certificate-contacts/set-certificate-contacts) for notifications. This is the contact for the Key Vault user. Key Vault doesn't enforce this step.
53
53
@@ -111,8 +111,8 @@ The following import format is supported for PEM files: a single PEM-encoded cer
111
111
When you import a certificate, ensure that the key is included in the file itself. If you have the private key separately in a different format, you need to combine the key with the certificate. Some certificate authorities provide certificates in different formats, so before importing the certificate, make sure that it's in .pem or .pfx format.
112
112
113
113
114
-
>[!NOTE]
115
-
>Ensure that no other meta data is present in the certificate file and that the private key not showing as encrypted.
114
+
>[!NOTE]
115
+
>Ensure that no other metadata is present in the certificate file and that the private key isn't showing as encrypted.
116
116
117
117
### Formats of merge CSR we support
118
118
@@ -122,7 +122,7 @@ Azure Key Vault supports PKCS#8 encoded certificates with the following headers:
122
122
123
123
-----END CERTIFICATE-----
124
124
125
-
>[!NOTE]
125
+
>[!NOTE]
126
126
> P7B (PKCS#7) signed certificate chains, commonly used by certificate authorities (CAs), are supported as long as they're base64-encoded. You can use [certutil -encode](/windows-server/administration/windows-commands/certutil#-encode) to convert to a supported format.
127
127
128
128
## Creating a certificate with a CA not partnered with Key Vault
Copy file name to clipboardExpand all lines: articles/key-vault/certificates/create-certificate-signing-request.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -68,7 +68,7 @@ The certificate request has now been successfully merged.
68
68
69
69
1. Create a certificate policy. Because the CA chosen in this scenario isn't partnered, **IssuerName** is set to **Unknown** and Key Vault doesn't enroll or renew the certificate.
@@ -89,7 +89,7 @@ The certificate request has now been successfully merged.
89
89
90
90
1. Merge the signed request in Key Vault. After the certificate request has been signed, you can merge it with the initial private/public key pair created in Azure Key Vault.
Copy file name to clipboardExpand all lines: articles/key-vault/certificates/create-certificate.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,11 +15,11 @@ ms.author: mbaldwin
15
15
16
16
# Certificate creation methods
17
17
18
-
A Key Vault (KV) certificate can be either created or imported into a key vault. When a KV certificate is created, the private key is created inside the key vault and never exposed to certificate owner. The following are ways to create a certificate in Key Vault:
18
+
A Key Vault certificate can be either created or imported into a key vault. When a Key Vault certificate is created, the private key is created inside the key vault and never exposed to the certificate owner. The following are ways to create a certificate in Key Vault:
19
19
20
20
-**Create a self-signed certificate:** Create a public-private key pair and associate it with a certificate. The certificate will be signed by its own key.
21
21
22
-
-**Create a new certificate manually:** Create a public-private key pair and generate an X.509 certificate signing request. The signing request can be signed by your registration authority or certification authority. The signed x509 certificate can be merged with the pending key pair to complete the KV certificate in Key Vault. Although this method requires more steps, it does provide you with greater security because the private key is created in and restricted to Key Vault.
22
+
-**Create a new certificate manually:** Create a public-private key pair and generate an X.509 certificate signing request. The signing request can be signed by your registration authority or certification authority. The signed X.509 certificate can be merged with the pending key pair to complete the Key Vault certificate in Key Vault. Although this method requires more steps, it does provide you with greater security because the private key is created in and restricted to Key Vault.
23
23
24
24
25
25
@@ -31,29 +31,29 @@ The following descriptions correspond to the green lettered steps in the precedi
31
31
4. Your chosen CA responds with an X509 Certificate.
32
32
5. Your application completes the new certificate creation with a merger of the X509 Certificate from your CA.
33
33
34
-
-**Create a certificate with a known issuer provider:** This method requires you to do a one-time task of creating an issuer object. Once an issuer object is created in your key vault, its name can be referenced in the policy of the KV certificate. A request to create such a KV certificate will create a key pair in the vault and communicate with the issuer provider service using the information in the referenced issuer object to get an x509 certificate. The x509 certificate is retrieved from the issuer service and is merged with the key pair to complete the KV certificate creation.
34
+
-**Create a certificate with a known issuer provider:** This method requires you to do a one-time task of creating an issuer object. Once an issuer object is created in your key vault, its name can be referenced in the policy of the Key Vault certificate. A request to create such a Key Vault certificate will create a key pair in the vault and communicate with the issuer provider service using the information in the referenced issuer object to get an X.509 certificate. The X.509 certificate is retrieved from the issuer service and is merged with the key pair to complete the Key Vault certificate creation.
35
35
36
36
37
37
38
38
The following descriptions correspond to the green lettered steps in the preceding diagram.
39
39
40
40
1. In the diagram, your application is creating a certificate, which internally begins by creating a key in your key vault.
41
41
2. Key Vault sends a TLS/SSL Certificate Request to the CA.
42
-
3. Your application polls, in a loop and wait process, for your Key Vault for certificate completion. The certificate creation is complete when Key Vault receives the CA’s response with x509 certificate.
42
+
3. Your application polls, in a loop and wait process, for your Key Vault for certificate completion. The certificate creation is complete when Key Vault receives the CA’s response with an X.509 certificate.
43
43
4. The CA responds to Key Vault's TLS/SSL Certificate Request with a TLS/SSL X.509 certificate.
44
44
5. Your new certificate creation completes with the merger of the TLS/SSL X.509 certificate for the CA.
45
45
46
46
## Asynchronous process
47
47
48
-
KV certificate creation is an asynchronous process. This operation will create a KV certificate request and return an http status code of 202 (Accepted). The status of the request can be tracked by polling the pending object created by this operation. The full URI of the pending object is returned in the LOCATION header.
48
+
Key Vault certificate creation is an asynchronous process. This operation creates a Key Vault certificate request and returns an HTTP status code of 202 (Accepted). The status of the request can be tracked by polling the pending object created by this operation. The full URI of the pending object is returned in the LOCATION header.
49
49
50
-
When a request to create a KV certificate completes, the status of the pending object will change to "completed" from "in progress", and a new version of the KV certificate will be created. This will become the current version.
50
+
When a request to create a Key Vault certificate completes, the status of the pending object changes to "completed" from "in progress", and a new version of the Key Vault certificate is created. This becomes the current version.
51
51
52
52
## First creation
53
-
When a KV certificate is created for the first time, an addressable key and secret are also created with the same name as the certificate. If the name is already in use, then the operation will fail with an http status code of 409 (conflict).
54
-
The addressable key and secret get their attributes from the KV certificate attributes. The addressable key and secret created this way are marked as managed keys and secrets, whose lifetime is managed by Key Vault. Managed keys and secrets are read-only. Note: If a KV certificate expires or is disabled, the corresponding key and secret will become inoperable.
53
+
When a Key Vault certificate is created for the first time, an addressable key and secret are also created with the same name as the certificate. If the name is already in use, then the operation fails with an HTTP status code of 409 (conflict).
54
+
The addressable key and secret get their attributes from the Key Vault certificate attributes. The addressable key and secret created this way are marked as managed keys and secrets, whose lifetime is managed by Key Vault. Managed keys and secrets are read-only. Note: If a Key Vault certificate expires or is disabled, the corresponding key and secret become inoperable.
55
55
56
-
If this is the first operation to create a KV certificate, a policy is required. A policy can also be supplied with successive create operations to replace the policy resource. If a policy isn't supplied, then the policy resource on the service is used to create a next version of KV certificate. While a request to create a next version is in progress, the current KV certificate, and corresponding addressable key and secret, remain unchanged.
56
+
If this is the first operation to create a Key Vault certificate, a policy is required. A policy can also be supplied with successive create operations to replace the policy resource. If a policy isn't supplied, then the policy resource on the service is used to create a next version of the Key Vault certificate. While a request to create a next version is in progress, the current Key Vault certificate, and corresponding addressable key and secret, remain unchanged.
57
57
58
58
## Self-issued certificate
59
59
To create a self-issued certificate, set the issuer name as "Self" in the certificate policy as shown in following snippet from certificate policy.
@@ -65,7 +65,7 @@ When a request to create a KV certificate completes, the status of the pending o
65
65
66
66
```
67
67
68
-
If the issuer name isn't specified, then the issuer name is set to "Unknown". When issuer is "Unknown", the certificate owner will have to manually get a x509 certificate from the issuer of their choice, then merge the public x509 certificate with the key vault certificate pending object to complete the certificate creation.
68
+
If the issuer name isn't specified, then the issuer name is set to "Unknown". When issuer is "Unknown", the certificate owner will have to manually get an X.509 certificate from the issuer of their choice, then merge the public X.509 certificate with the key vault certificate pending object to complete the certificate creation.
69
69
70
70
```
71
71
"issuer": {
@@ -74,7 +74,7 @@ When a request to create a KV certificate completes, the status of the pending o
74
74
75
75
```
76
76
77
-
## Partnered CA Providers
77
+
## Partnered CA providers
78
78
79
79
Certificate creation can be completed manually or using a "Self" issuer. Key Vault also partners with certain issuer providers to simplify the creation of certificates. The following types of certificates can be ordered for key vault with these partner issuer providers.
80
80
@@ -83,9 +83,9 @@ Certificate creation can be completed manually or using a "Self" issuer. Key Vau
83
83
|DigiCert|Key Vault offers OV or EV SSL certificates with DigiCert| [Integration Guide](./how-to-integrate-certificate-authority.md)
84
84
|GlobalSign|Key Vault offers OV or EV SSL certificates with GlobalSign| [Integration Guide](https://support.globalsign.com/code-signing/Code-Signing-certificate-setup-in-Azure-Key-vault)
85
85
86
-
A certificate issuer is an entity represented in Azure Key Vault (KV) as a CertificateIssuer resource. It is used to provide information about the source of a KV certificate; issuer name, provider, credentials, and other administrative details.
86
+
A certificate issuer is an entity represented in Azure Key Vault as a CertificateIssuer resource. It provides information about the source of a Key Vault certificate: issuer name, provider, credentials, and other administrative details.
87
87
88
-
When an order is placed with the issuer provider, it may honor or override the x509 certificate extensions and certificate validity period based on the type of certificate.
88
+
When an order is placed with the issuer provider, it may honor or override the X.509 certificate extensions and certificate validity period based on the type of certificate.
89
89
90
90
Authorization: Requires the certificates/create permission.
Copy file name to clipboardExpand all lines: articles/key-vault/certificates/faq.yml
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -64,7 +64,7 @@ sections:
64
64
- question: |
65
65
How can I resolve this error? "The specified PEM X.509 certificate content is in an unexpected format. Check if certificate is in valid PEM format."
66
66
answer: |
67
-
Verify that the content in the PEM file is uses UNIX-style line separators `(\n)`
67
+
Verify that the content in the PEM file uses UNIX-style line separators `(\n)`
68
68
- question: |
69
69
Can I import an expired certificate to Azure Key Vault?
70
70
answer: |
@@ -88,7 +88,7 @@ sections:
88
88
- question: |
89
89
How do I combine certificates in a single .PEM or .PFX file to have the whole certificate bundle imported to Key Vault?
90
90
answer: |
91
-
Certificate Authorities may provide with the option to either download certificate individually (root, intermediate, leaf) or download all of them in a single file. When you import certificates into Key Vault, Certificate Authorities allows you to import one or an entire whole chain.
91
+
Certificate authorities may provide the option to either download certificates individually (root, intermediate, leaf) or download all of them in a single file. When you import certificates into Key Vault, certificate authorities allow you to import one or an entire chain.
Copy file name to clipboardExpand all lines: articles/key-vault/certificates/overview-renew-certificate.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -62,11 +62,11 @@ To renew a nonintegrated CA certificate:
62
62
3. On the **Create a certificate** page, make sure the **Generate** option is selected under **Method of Certificate Creation**.
63
63
4. Verify the **Subject** and other details about the certificate and then select **Create**.
64
64
5. You should now see the message **The creation of certificate `<certificate-name>` is currently pending. Click here to go its Certificate Operation to monitor the progress**
65
-
1. Select on the message and a new pane should be shown. The pane should show the status as "In Progress". At this point, Key Vault has generated a CSR that you can download using the **Download CSR** option.
65
+
1. Select the message and a new pane appears. The pane should show the status as "In Progress". At this point, Key Vault has generated a CSR that you can download using the **Download CSR** option.
66
66
1. Select **Download CSR** to download a CSR file to your local drive.
67
67
1. Send the CSR to your choice of CA to sign the request.
68
68
1. Bring back the signed request, and select **Merge Signed Request** on the same certificate operation pane.
69
-
10. The status after merging will show **Completed** and on the main certificate pane you can hit**Refresh** to see the new version of the certificate.
69
+
10. The status after merging shows **Completed** and on the main certificate pane you can select**Refresh** to see the new version of the certificate.
Copy file name to clipboardExpand all lines: articles/key-vault/certificates/quick-create-java.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -189,7 +189,7 @@ CertificateClient certificateClient = new CertificateClientBuilder()
189
189
190
190
### Save a certificate
191
191
192
-
Now that your application is authenticated, you can create a certificate in your key vault using the `certificateClient.beginCreateCertificate` method. This requires a name for the certificate and a certificate policy -- we've assigned the value "myCertificate" to the `certificateName` variable in this sample and use a default policy.
192
+
Now that your application is authenticated, you can create a certificate in your key vault using the `certificateClient.beginCreateCertificate` method. This requires a name for the certificate and a certificate policy -- the value "myCertificate" is assigned to the `certificateName` variable in this sample and a default policy is used.
193
193
194
194
Certificate creation is a long running operation, for which you can poll its progress or wait for it to complete.
0 commit comments