Support SSL certificates stored in Key Vault secrets for listeners and backend HTTP settings on Application Gateway
Azure Web Apps support the ability to store an SSL certificate in a Key Vault secret. A certificate resource can be created that references the Key Vault secret. The App service will periodically check for an updated SSL certificate in the Key Vault. The Application Gateway needs to have the same support for storing the SSL certificates in the Key Vault. It should be able to reference a Key Vault secret that contains the SSL certificate in the listener and backend HTTP settings configuration. This capability will allow the management of SSL certificates for Application Gateway and the Web Apps in a single place.
Mike Webber
shared this idea
We are planning to support SSL certificates stored in Key Vault secrets for listeners and backend HTTP settings on AppGw
14 comments
-
Anonymous
commented
Application Gateways not able to access the certificate from Azure Key Vault is a security problem because of the need to export a PFX.
It also greatly diminishes the value of the higher price of an Azure App Service Certificate (ASC). It is no more secure than going to any other CA at this point who can charge far less for a certificate of the same value. -
Greg Lloyd
commented
Updates? This is a seriously needed feature. Especially for automation to prevent downtime for applications.
-
Corey Zwart
commented
Any updates? Would love to be able to administer the certificates in a central place rather than every deployed Application Gateway.
-
John Gilmartin
commented
Pleased to see this is on the roadmap but disappointed to see that it has been so since 2016 and yet still not available. With this item and very similar one https://feedback.azure.com/forums/217313-networking/suggestions/17205926-integration-with-key-vault-certificates there is plenty of demand, us included.
-
Max Khon
commented
+1
-
Jens Peter Secher
commented
+1
-
Richard J
commented
Hi Microsoft,
What is the ETA for this?
-
Joe H
commented
SSL certificate private key portions are CONSTANTLY exposed on some DevOps workstation, because App Services don't support the generation of a CSR.
KeyVault supports that -- but when I create an SSL certificate via KeyVault, I can't use it directly in an AppService without allowing the entire certificate to be exported - with its private key portion.
Back to square one.
Besides, I'd like my HTTPS certificate to be HSM-backed.
It seems like I'm asking for too much. But at the very least, allow me to use non-exportable HTTPS certificates for Azure-based web sites, where the private key NEVER has to be on a DevOps person's workstation. That's just unnecessary attack surface.
-
Jev
commented
Hi Azure Networking team. Key Vault integration would be a welcome addition. Especially when using ARM deployment model. Hence an ETA would be greatly appreciated!
-
Anonymous
commented
Hello, Azure Networking team. By when we can expect Key Vault support i Application Gateway?
-
Moim Hossain
commented
Is there any ETA for this?
-
Moim Hossain
commented
+1
-
Anonymous
commented
+1
-
KevBow
commented
We really need this too. Any ideas on timings in that plan ? Q1/Q2/2019?