Examkin

Question

Difficulty: Very hardAzure Key Vault Secret, Key, and Certificate Management

You are developing a secure C# .NET console application that uses the `Azure.Security.KeyVault.Certificates` SDK. The application must provision a new SSL/TLS certificate inside Azure Key Vault. Your organization requires that the certificate be signed by an internal corporate Certificate Authority (CA) that is not integrated with Azure Key Vault. You need to complete the process of generating the certificate while keeping the private key secure within the key vault. Arrange the steps in the correct order to configure, sign, and complete the certificate creation process.

  1. 1Call `StartCreateCertificateAsync` on a `CertificateClient` instance with a certificate policy specifying the issuer name as "Unknown".
  2. 2Retrieve the pending `CertificateOperation` from Azure Key Vault and extract the base64-encoded Certificate Signing Request (CSR) from the operation's properties.
  3. 3Submit the extracted CSR to the non-integrated external Certificate Authority (CA) to get the signed certificate chain.
  4. 4Call `MergeCertificateAsync` on the `CertificateClient` with the signed certificate chain to complete the pending operation.

Answer

First, start the certificate creation process using a policy with the issuer specified as 'Unknown'. Second, retrieve the pending certificate operation to extract the generated Certificate Signing Request (CSR). Third, submit the CSR to the non-integrated Certificate Authority to obtain the signed certificate. Finally, merge the signed certificate back into Azure Key Vault using the certificate client to complete the operation.
The correct sequence starts with initiating the request in Key Vault using 'Unknown' as the issuer, which forces the key vault to generate the private key and prepare a pending operation. Next, the pending operation is queried to extract the CSR. Then, the CSR is signed by the external CA. Finally, the signed certificate is merged back into Key Vault to associate it with the private key and activate the certificate resource.

Step-by-Step Solution

1
Initiate the creation request using `CertificateClient.StartCreateCertificateAsync` with a policy where `IssuerName` is set to "Unknown".
A pending `CertificateOperation` is created inside Azure Key Vault, and the private key is generated within the vault.
Azure Key Vault must generate the public/private key pair and create a CSR. Setting the issuer to "Unknown" is required for non-integrated CAs.
2
Query the key vault to retrieve the active `CertificateOperation` and extract the CSR from its properties.
The base64-encoded CSR string is retrieved.
The CSR is needed so that the external CA can sign it, confirming the identity and public key details.
3
Submit the CSR to the external CA and download the signed certificate chain.
The signed X.509 certificate file containing the certificate chain.
The external CA acts as the trust anchor and signs the public key provided in the CSR.
4
Call `CertificateClient.MergeCertificateAsync` to import the signed certificate.
The certificate operation is completed, and the active certificate is now available in Azure Key Vault.
Merging associates the signed certificate with the private key that remained securely inside Key Vault, finalizing the enrollment lifecycle.

Key Concept

Azure Key Vault Certificate Enrollment with Non-Integrated Certificate Authorities
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic