Examkin

Question

Difficulty: HardAzure Key Vault Secret, Key, and Certificate Management

You are developing a C# daemon application that runs on an Azure Virtual Machine. The application must automate the renewal of an Azure Key Vault certificate named 'ssl-cert' which is issued by a non-integrated internal Certificate Authority (CA).

The application must run under a user-assigned managed identity named 'app-identity'. The renewal workflow requires:
1. Retrieving the pending Certificate Signing Request (CSR) generated by Key Vault.
2. Submitting the CSR to the CA and receiving the signed certificate.
3. Merging the signed certificate back into Key Vault to complete the process.

You need to configure the required permissions and implement the code using the Azure.Security.KeyVault.Certificates library.

Which of the following configurations and code segments should you implement?

  1. Assign the 'app-identity' to the Virtual Machine and grant it the Key Vault Certificates Officer Azure RBAC role. Use the following C# code:

    var client = new CertificateClient(new Uri("https://vault.vault.azure.net/"), new DefaultAzureCredential());
    CertificateOperation operation = await client.GetCertificateOperationAsync("ssl-cert");
    byte[] csr = operation.Csr;
    // Submit to CA and receive signedCertBytes
    await client.MergeCertificateAsync(new MergeCertificateOptions("ssl-cert", new[] { signedCertBytes }));    Answer
  2. B
    Assign the 'app-identity' to the Virtual Machine and configure a Key Vault Access Policy granting the identity Get and List permissions under Secret Permissions. Use the following C# code:

    var client = new CertificateClient(new Uri("https://vault.vault.azure.net/"), new DefaultAzureCredential());
    CertificateOperation operation = await client.GetCertificateOperationAsync("ssl-cert");
    byte[] csr = operation.Csr;
    // Submit to CA and receive signedCertBytes
    await client.MergeCertificateAsync(new MergeCertificateOptions("ssl-cert", new[] { signedCertBytes }));
  3. C
    Enable a system-assigned managed identity on the Virtual Machine, but configure Key Vault access and RBAC roles exclusively for 'app-identity' (the user-assigned identity). Do not assign 'app-identity' to the Virtual Machine. Use the following C# code:

    var client = new CertificateClient(new Uri("https://vault.vault.azure.net/"), new DefaultAzureCredential());
    CertificateOperation operation = await client.GetCertificateOperationAsync("ssl-cert");
    byte[] csr = operation.Csr;
    // Submit to CA and receive signedCertBytes
    await client.MergeCertificateAsync(new MergeCertificateOptions("ssl-cert", new[] { signedCertBytes }));
  4. D
    Assign the 'app-identity' to the Virtual Machine and grant it the Key Vault Certificates Officer Azure RBAC role. Configure the application to reference the certificate secret in Azure App Configuration using the key-value reference value '@KeyVault(SecretUri=https://vault.vault.azure.net/secrets/ssl-cert)'. Use the following C# code:

    var client = new CertificateClient(new Uri("https://vault.vault.azure.net/"), new DefaultAzureCredential());
    CertificateOperation operation = await client.GetCertificateOperationAsync("ssl-cert");
    byte[] csr = operation.Csr;
    // Submit to CA and receive signedCertBytes
    await client.MergeCertificateAsync(new MergeCertificateOptions("ssl-cert", new[] { signedCertBytes }));

Answer

To perform certificate operations such as retrieving pending operations and merging certificates in Azure Key Vault, the application identity must possess certificate permissions (like the Key Vault Certificates Officer Azure RBAC role) rather than secret permissions. Furthermore, the user-assigned managed identity must be associated with the virtual machine hosting the application. The Azure.Security.KeyVault.Certificates SDK requires using GetCertificateOperationAsync to access the pending CSR and MergeCertificateAsync to upload the signed public certificate.
To complete the renewal of a certificate from a non-integrated CA, the application must fetch the pending CSR using GetCertificateOperationAsync, sign it at the CA, and then call MergeCertificateAsync to combine the signed certificate with the private key stored in Key Vault. Additionally, the user-assigned managed identity must be associated with the VM and granted the Key Vault Certificates Officer role to authorize the action.

Step-by-Step Solution

1
Ensure the user-assigned managed identity is attached to the Virtual Machine hosting the application.
The Virtual Machine environment can retrieve Azure AD tokens on behalf of the user-assigned managed identity.
DefaultAzureCredential attempts to acquire a token using the associated identities on the hosting environment.
2
Grant the user-assigned managed identity the 'Key Vault Certificates Officer' role (or appropriate certificate-level Access Policy permissions).
The identity is authorized to get certificate operations and merge certificates.
Secrets permissions do not authorize certificate lifecycle management actions.
3
Use GetCertificateOperationAsync to retrieve the pending CSR.
A CertificateOperation object containing the DER-encoded CSR is retrieved.
Key Vault generates the CSR and retains the private key during the initial certificate creation stage.
4
Use MergeCertificateAsync to upload the signed certificate from the CA.
The signed public key is combined with the private key stored inside Key Vault, completing the certificate.
For non-integrated CAs, merging completes the pending renewal process.

Key Concept

Azure Key Vault Certificate Lifecycle and Renewal for Non-Integrated CAs
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic