PKI CA integration with AzureHSM vault

Question

Hello

Can the PKI certificate authority on the promise sign the certificate using a private key generated in the Azure HSM vault?

If so, what do I need to do to make it happen?

Answer 1

Hello @ArchB,

Thank you for posting your query on Microsoft Q&A.

Yes, the PKI(Public Key Infrastructure) certificate authority(CA) on-premises can sign a certificate using a private key generated in the Azure HSM vault.

Azure Key Vault certificate support provides for management of your X.509 certificates and the following behaviors:

• Allows a certificate owner to create a certificate through a key vault creation process or through the import of an existing certificate. Imported certificates include both self-signed certificates and certificates that are generated from a certificate authority (CA).

When a Key Vault certificate is created, it can be retrieved from the addressable secret with the private key in either PFX or PEM format. The policy that's used to create the certificate must indicate that the key is exportable. If the policy indicates that the key is non-exportable, then the private key isn't a part of the value when it's retrieved as a secret.

For additional details regarding Azure Key Vault Certificates, please refer to the below document for your reference.

https://learn.microsoft.com/en-us/azure/key-vault/certificates/about-certificates

For a certificate import operation, Azure Key Vault accepts two certificate file formats: PEM and PFX. Although there are PEM files with only the public portion, Key Vault requires and accepts only a PEM or PFX file with a private key.

Please refer to the below document for the steps to Import a certificate in Azure Key Vault.

https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal

Azure Key Vault supports storing digital certificates issued by any certificate authority (CA). It supports creating a certificate signing request (CSR) with a private/public key pair. The CSR can be signed by any CA (an internal enterprise CA or an external public CA). A certificate signing request (CSR) is a message that you send to a CA in order to request a digital certificate.

Please follow the steps mentioned in the below document to Add certificates in Key Vault issued by non-partnered Certificate Authorities(CAs).

https://learn.microsoft.com/en-us/azure/key-vault/certificates/create-certificate-signing-request?tabs=azure-portal

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks and Regards,

Sanoop Mohan