Azure Key vault - Certificates management

Jyoti Sachdeva 41 Reputation points
2022-12-05T04:44:36.923+00:00

Hi Team,

I have the below queries for certificates management in Azure Key Vault

  1. For notifications regarding the certificate expiry or renewal etc, I want to know if certificate contacts can accept a distribution list to send out emails to all the members that are a part of that distribution list. This avoids us having to add individual email id to certificate contacts.
    1. After the certificate renewal in Azure Key vault, any changes are required for application to complete the certificate rotation?
Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,114 questions
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
6,869 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Roderick Bant 2,046 Reputation points
    2022-12-05T09:22:06.597+00:00

    Hi @Jyoti Sachdeva

    You can add any email address as a contact for certificate renewal. So this can be the address of either a single user or the address tied to a distribution group. Azure itself is unaware of anything other than the email address. See the documentation on Add-AzKeyvaultCertificateContact for details on how to add the contact.

    As long as you dont specify a specific certificate version in your app references to keyvault, Azure FrontDoor, App Gateway and App Service will detect any version updates and rotate within 24 hours. So as long as you renew more than 24 hours before expiry, no changes would be needed.