key vault certificate's Issuance Policy

Wang Meihua 115

I wanted to change my certificate's "Lifetime Action Type" and "Number ofDay Before Expiry" on below page by following https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-rotate-certificates#update-lifecycle-attributes-of-a-stored-certificate , but it states "Issuance policies only affect certificates that will be issued in the future. Modifying this issuance policy will not affect any existing certificates." on the top of the page, does it mean I can't mofify "Lifetime Action Type" and "Number ofDay Before Expiry" for my existed certificates? thank you.

User's image

1 answer

Deepanshu katara 13,840 Reputation points MVP

2024-11-22T08:15:01.6566667+00:00
Hello , Welcome to MS Q&A

Yes, you are correct. Issuance policies in Azure Key Vault only apply to certificates that will be issued in the future. Modifying an issuance policy will not have any impact on existing certificates that are already present in the Key Vault.

References:

About Azure Key Vault certificates

Please let us know if any questions

Kindly accept answer if it helps

Thanks

Deepanshu
Please sign in to rate this answer.
FrankEscarosBuechsel-MSFT 895 Reputation points Microsoft Employee

2024-11-22T10:35:45.2166667+00:00

@Wang Meihua

Since you are looking for modifying the life-cycle of an existing certificate @Deepanshukatara-6769 provided the correct response to you.

Depending on your intention on why you would want to have the life-time extended a few options would include the following to make that process easier in the future, also assuming that 12 months validity is not something you will be able to modify too much for longer time frames with modern browser implementations as all have either moved to a framework displaying warnings to end users for long running certificates or are in the process of doing so, in general the industry is moving towards shorter certificate life-cycles:

If you are integrating with a Microsoft trusted CA provider (DigiCert and DocuSign) the rotation will be handled for you by the system.

If you are using self-signed certificates an auto-renewal is also possible by the system.

You can read more about these options here: Renew your Azure Key Vault certificates

If you are using your own internal CA you will require some manual steps at the moment, however you may want to look into further automating these steps.

The high level steps for this would look like the following:

Recognize the upcoming expiration.

Create a CSR for the new certificate.

Sign the new request with your own CA.

Update the certificate in Azure Key Vault.

I can provide you some resources for each of the steps to get you started on that process:

Recognize the upcoming expiration:

You can either use a scheduled task to check in Azure Key Vault for certificates close to expiration or use Outlook rules on a service machine to trigger a script on demand based on the incoming reminder email, you can also monitor Azure Key Vault using Azure Event Grid if you preferred an event driven architecture, you have several options here indeed.

The following Learn article provides information on how to create a certificate signing request Create and merge a certificate signing request in Key Vault

To automate the signing of the actual request with an internal Microsoft CA you can take a look at the certreq tool for which you can find more information in this Learn article: certreq if you are using a different CA provider they should be having similar documentation on their tooling for this.

The following Learn article section describes how you can add the newly signed certificate to Azure Key Vault Renew a nonintegrated CA certificate.

FrankEscarosBuechsel-MSFT 895 Reputation points Microsoft Employee

2024-11-27T20:18:22.71+00:00

Hi @Wang Meihua ,

Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.  And, if you have any further questions do let us know.

FrankEscarosBuechsel-MSFT 895 Reputation points Microsoft Employee

2024-12-02T10:48:33.32+00:00

Hi @Wang Meihua ,

Just checking in to see if you had a chance to see the provided answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.  And, if you have any further questions do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

key vault certificate's Issuance Policy

1 answer

Your answer