azuressl

Deploy .PFX certificate with intermediate certificates to Azure Key Vault

I am migrating my Classic Azure Cloud Service to Extended Azure Cloud Service, part of this process seems to require the use of Azure Key Vaults to store certificates. I completed the in-place migration from Classic to Extended and this appears to have been a success.

However, if I now try to perform a re-deployment using the same configuration (as generated by the in-place migration), on publish I get errors:

Error: certificate: ‘Go Daddy Class 2 Certification Authority’ with thumbprint: 2796BAE63F1801E277261BA0D77770028F20EEE4 for role: xxx is not present in the key vault: https://kv-xxx.vault.azure.net/
Error: certificate: ‘Go Daddy Secure Certificate Authority - G2’ with thumbprint: 27AC9369FAF25207BB2627CEFACCBE4EF9C319B8 for role: XxxWebApp is not present in the key vault: https://kv-xxx.vault.azure.net/
Error: certificate: ‘Go Daddy Root Certificate Authority - G2’ with thumbprint: 340B2880F446FCC04E59ED33F52B3D08D6242964 for role: XxxWebApp is not present in the key vault: https://kv-xxx.vault.azure.net/

In my classic cloud service, I simply upload my .pfx to the Certificates and this single upload would yield 4 entries in the:

enter image description here

However, if I upload the same .pfx to Azure Key Vault store, I only get one entry:

enter image description here

So this would explain why I am getting the publish error messages as there is are no entries imported to match the thumbprint for the CA certificates.

So how can I actually get all the certificates in the .pfx into the Azure Key Vault (just as was so easy to do in Classic mode)

My ServiceConfiguration.cscfg:

<Certificate name="xxx" thumbprint="6Bxxx29" thumbprintAlgorithm="sha1" />
  <Certificate name="Go Daddy Class 2 Certification Authority" thumbprint="2796BAE63F1801E277261BA0D77770028F20EEE4" thumbprintAlgorithm="sha1" />
  <Certificate name="Go Daddy Secure Certificate Authority - G2" thumbprint="27AC9369FAF25207BB2627CEFACCBE4EF9C319B8" thumbprintAlgorithm="sha1" />
  <Certificate name="Go Daddy Root Certificate Authority - G2" thumbprint="340B2880F446FCC04E59ED33F52B3D08D6242964" thumbprintAlgorithm="sha1" />
Solution

  • Info from Microsoft:

    ...when you upload a PFX file to Azure Key Vault, only the primary certificate is stored in that specific Key Vault entry, and the intermediate and root certificates are not automatically included as separate entries. If you need to store the entire certificate chain in Azure Key Vault in separate entries, you will need to upload each certificate (primary, intermediate, and root) separately, ensuring that each one is stored in its respective Key Vault entry.

    And info from https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal:

    In Azure Key Vault, supported certificate formats are PFX and PEM. .pem file format contains one or more X509 certificate files. .pfx file format is an archive file format for storing several cryptographic objects in a single file i.e. server certificate (issued for your domain), a matching private key, and may optionally include an intermediate CA.

    The last part here " and may optionally include an intermediate CA." suggests that the Azure Key Vault CAN include intermediate CA BUT they are just not listed" - very subtle wording here and confusing.

    Thus, the solution seems to be to delete the intermediate certificates listed in the .CSCFG and .CSDEF and assume that although they are not listed in the Azure Key Vault that they will be deployed.