How do I create the TLS Certificate for the Azure Premium firewall with the "CA" flage true. This is needed for the TLS inspection.

Steven Davis 21

Hello all.
I have been suffering for weeks now. In Azure Premium firewall, I want t enable TLS inspection. That requires a Certificate I the key vault. That certificate has special requirements with the most complicated being "CA" = true. This value would indicate I am a certificate authority and no vendor will do this. I have talked with Digicert and Godaddy, along with four others.
So how do I enable TLS inspection and have an internal certificate that can be installed on all the VM's?

Steven Davis 21 Reputation points

2022-10-31T20:14:28.667+00:00

The actual details from Microsoft are:

Ensure your CA certificate complies with the following requirements:
• When deployed as a Key Vault secret, you must use Password-less PFX (Pkcs12) with a certificate and a private key.
• It must be a single certificate, and shouldn’t include the entire chain of certificates.
• It must be valid for one year forward.
• It must be an RSA private key with minimal size of 4096 bytes.
• It must have the KeyUsage extension marked as Critical with the KeyCertSign flag (RFC 5280; 4.2.1.3 Key Usage).
• It must have the BasicContraints extension marked as Critical (RFC 5280; 4.2.1.9 Basic Constraints).
• The CA flag must be set to TRUE.
• The Path Length must be greater than or equal to one.
KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee

2022-11-01T11:31:01.803+00:00

Hi @Steven Davis ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to configure TLS inspection in Azure Firewall and would like to know the certificate requirements.

I see you have created a support incident with us, I shall track it and keep this thread updated.

Meanwhile, in case you have a TestEnvironment, can you try using Self-signed certificate and check if that is working or not?

Refer : Create your own self-signed CA certificate

Cheers,
Kapil
Steven Davis 21 Reputation points

2022-11-02T14:18:17.497+00:00

Hello.
The certificate I need is for a production environment. The article says that self-signed certificates are only for testing.
After I test how do I create the certificate to be used in production for the long term?
KapilAnanth-MSFT 35,001 Reputation points Microsoft Employee

2022-11-17T13:28:37.417+00:00

Hi @Steven Davis ,

Since you already have an existing support request open with our team, I would suggest you wait for their updates.

Let us know if we can be of any other assistance.

Cheers,
Kapil
IggyHud-4136 5 Reputation points

2023-02-03T06:42:13.6733333+00:00

Hi @Steven Davis , did you end up finding a solution? Facing the exact same situation. Thank you!
IggyHud-4136 5 Reputation points

2023-02-03T06:42:58.28+00:00

Duplicate comment. Please delete
Steven Davis 21 Reputation points

2023-02-06T02:40:05.7+00:00

As of 2/3/23 I have not found a resolution to the certificate problem. Microsoft support says it is out of the scope of a support contract. :(
IggyHud-4136 5 Reputation points

2023-02-06T03:27:54.6333333+00:00

This is hardly ideal however I can understand he position of the certificate vendors and Microsoft. There is a way out: create your own CA certificate for TLS inspection and install it on the Premium Firewall and also into the VMs and any other Azure services you want to traverse the firewall for TLS inspection so these services know to trust your custom CA certificate. Sounds like a fair amount of work but it is what it is - after all you're trying to man-in-the-middle TLS so you need to ensure your VMs and services explicitly trust your custom CA-issued certificates. Just make sure nobody has access to the private key of the CA certificate apart from the Azure Premium Firewall and that you are not using the CA certificate to issue any other certs.
IggyHud-4136 5 Reputation points

2023-02-06T03:33:08.8833333+00:00

I can understand the position of the certificate vendors and Microsoft. Fortunately, there is a way out, although requiring more work: create your own CA or Subordinate CA certificate and install it on the Premium Firewall and also into the VMs and any other Azure services you want traversing the firewall for TLS inspection so that these services know to trust your custom CA certificate. Sounds like a bit of work but it is what it is - after all you're trying to man-in-the-middle TLS so you need to ensure your VMs and services explicitly trust your custom CA certificate and therefore all the certificates that the firewall will be generating dynamically using that CA cert. Just make sure nobody has access to the private key of the CA certificate apart from the Azure Premium Firewall and that you are not using the CA certificate to issue any other certs.
Kuldeep Sharma 0 Reputation points

2023-07-25T17:06:25.58+00:00

Hey, I am facing the same issue. We are using godaddy, but couldn't figure out how to do this. Self signed process is working, but then don't want to do the manual stuff on trusting the cert on each client.

Does any one have used this use case?
Steven Davis 21 Reputation points

2023-07-25T17:16:18.3766667+00:00

My end result was to call Western NRG (805) 658-0800 a consultant I know that works on SonicWalls. They install a VM and configured it all. Saves a lot of hair pulling.

1 answer

Christian Nicholls 0 Reputation points

2023-10-05T07:58:43.78+00:00

For anyone else stumbling into this, I found this blog post a LOT more helpful than the official docs which I found rather esoteric on specifics:

https://hovermind.com/azure-firewall/tls-inspection.html
Please sign in to rate this answer.

0 comments No comments
Sign in to comment