Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

You need to create a new SSL/TLS certificate in Azure Key Vault using a non-integrated Certificate Authority (CA). Which sequence of steps should you perform to generate the Certificate Signing Request (CSR) and complete the certificate creation in Key Vault?

  1. 1Initiate the certificate creation operation in Azure Key Vault with the Issuer set to Unknown.
  2. 2Download the Certificate Signing Request (CSR) from the pending certificate operation in Azure Key Vault.
  3. 3Submit the Certificate Signing Request (CSR) to the external Certificate Authority (CA) and download the signed certificate.
  4. 4Merge the signed certificate from the CA back into the pending certificate operation in Azure Key Vault.

Answer

The correct sequence starts with initiating the certificate creation operation in Key Vault with the Issuer set to Unknown. Next, you download the generated Certificate Signing Request (CSR). You then submit this CSR to the external Certificate Authority (CA) and retrieve the signed certificate. Finally, you merge the signed certificate back into the pending certificate operation in Key Vault to complete the process.
The correct process involves first initiating the certificate operation with the issuer set to Unknown, which generates the CSR. The CSR is then retrieved and signed by the external CA. Finally, the signed certificate is merged back into the pending operation to match the private key.

Step-by-Step Solution

1
Initiate the certificate creation in Azure Key Vault with the issuer configuration set to Unknown.
Key Vault creates a pending certificate operation, generating a private/public key pair and a Certificate Signing Request (CSR).
Specifying Unknown as the issuer tells Key Vault that an external, non-integrated CA will be responsible for signing the certificate.
2
Retrieve the CSR from the pending certificate operation.
You obtain the CSR file (PEM format) from the Azure Portal, CLI, or SDK.
You must download the CSR to pass it to the external authority.
3
Submit the CSR to the external CA and retrieve the signed certificate.
The CA signs the public key and issues a certificate (usually as a .cer or .p7b file).
The external CA must authenticate the request and sign it to make the certificate valid.
4
Merge the signed certificate back into the pending Key Vault certificate operation.
The certificate state updates to Active and is ready for use.
Merging links the public certificate from the CA with the private key stored securely in Key Vault.

Key Concept

Creating certificates in Azure Key Vault using a non-integrated CA requires generating a CSR, obtaining the signed certificate externally, and merging it back to associate it with the private key.
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic