Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

Your company is configuring SSL/TLS certificates for a web application and wants to automate the certificate renewal lifecycle using an integrated Certificate Authority (CA) partner, DigiCert. You need to configure Azure Key Vault to automatically request and renew certificates from DigiCert. Which sequence of actions must you perform to configure the integrated certificate auto-renewal?

  1. 1Retrieve the organization ID, API key, and account credentials from the partner Certificate Authority.
  2. 2Register the partner Certificate Authority as a certificate issuer in the Azure Key Vault using the retrieved credentials.
  3. 3Create a certificate policy in the Azure Key Vault that specifies the registered issuer and configures a lifetime trigger for auto-renewal.
  4. 4Create the certificate in the Azure Key Vault using the configured certificate policy to initiate the initial enrollment and enable automatic renewals.

Answer

Retrieve the organization ID, API key, and account credentials from the partner Certificate Authority; register the partner Certificate Authority as a certificate issuer in the Azure Key Vault using the retrieved credentials; create a certificate policy in the Azure Key Vault that specifies the registered issuer and configures a lifetime trigger for auto-renewal; and create the certificate in the Azure Key Vault using the configured certificate policy to initiate the initial enrollment and enable automatic renewals.
The correct configuration sequence for integrated CA certificate auto-renewal begins with obtaining the credentials from the CA provider. Next, these credentials are used to register the CA as an issuer object within the Key Vault. Once the issuer exists, you define a certificate policy referencing that issuer and setting the auto-renewal lifetime trigger. Finally, you create the certificate based on that policy to trigger the initial generation and establish the auto-renewal lifecycle.

Step-by-Step Solution

1
Retrieve organization details and API keys from DigiCert.
Credentials are ready to be used in Azure Key Vault.
Azure Key Vault requires CA account credentials to authenticate and communicate with the partner CA.
2
Register the partner CA as an issuer in the Key Vault.
An issuer object is created in the Key Vault.
A certificate policy cannot reference an issuer until the issuer is registered in the Key Vault.
3
Create a certificate policy containing issuer details and lifetime actions.
A policy defining the auto-renewal percentage trigger is ready.
The policy must exist to define the properties of the certificate and specify that the CA should auto-renew it at a specific lifetime milestone.
4
Create the certificate in Key Vault using the policy.
The initial certificate is generated and auto-renewal is active.
This initiates the initial contact with the CA and configures the certificate for the automated renewal cycle.

Key Concept

Azure Key Vault integrated Certificate Authority auto-renewal configuration
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic