Azure v1 to v2 migration script not support key vault

Question

Azure v1 to v2 migration script not support key vault

Himanshuk 166

https://www.powershellgallery.com/packages/AzureAppGWMigration/1.0.10 can you make provision to migrate v1 to v2 app gateway using key vault certificates. it's not possible to upload certificate during migration from key vault, there is no provision at all

VasimTamboli 5,215 Reputation points

2023-05-31T09:23:40.38+00:00

The AzureAppGWMigration script you mentioned is a community-contributed PowerShell script, and its functionality and features are determined by the script's author and maintainers. As such, if the script currently does not support migrating key vault certificates during the v1 to v2 migration, you may need to explore alternative approaches to achieve your desired outcome.

One possible solution could be to perform the following steps manually:

Retrieve the required certificate from the key vault: Use the appropriate Azure PowerShell or Azure CLI commands to retrieve the certificate from your key vault. You can then export the certificate to a file or directly install it on the target v2 Application Gateway.

Upload the certificate to the v2 Application Gateway: Once you have the certificate file, you can upload it to the target v2 Application Gateway using the Azure portal, Azure PowerShell, or Azure CLI. This step allows you to associate the certificate with the v2 Application Gateway.

By manually retrieving the certificate from the key vault and uploading it to the v2 Application Gateway, you can ensure that the necessary certificates are available and associated correctly during the migration process.

It's important to note that manually performing these steps requires a good understanding of Azure Application Gateway and its configuration options. Make sure to carefully follow the Azure documentation and best practices to ensure a successful migration.

Additionally, you may consider reaching out to the author or maintainers of the AzureAppGWMigration script to provide feedback or request support for migrating key vault certificates. They may consider adding this feature in future updates of the script.

I hope this information helps you in finding a solution to migrate your key vault certificates during the v1 to v2 migration of the Application Gateway. If you have any further questions or need additional assistance, please let me know.
Himanshuk 166 Reputation points

2023-05-31T10:05:21.0166667+00:00

I have find an alternative where I have downloaded key vault certificate and try to pass in migration script where I have got an error and pfx certificate is not in the coMessage : Certificate /subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Network/applicationGateways/AppGWxxx/sslCertificates/xxx does not have Private Key.
Himanshuk 166 Reputation points

2023-05-31T10:15:40.5333333+00:00

Message : Certificate /subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Network/applicationGateways/AppGWxxx/sslCertificates/xxx does not have Private Key.

This error I am getting while passing downloaded pfx certificate externally, can you please take a look ?
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-05-31T10:44:26.9+00:00

Hello @Himanshuk ,

I’ve reached out to the Application gateway team to understand the PowerShell script that is used for migration and how can we add a manually downloaded certificate from key vault to the migration script. Once I get a response, I will share an update.

Regards,

Gita

1 answer

Your answer

Himanshuk 166 Reputation points

2023-05-31T10:05:21.0166667+00:00

I have find an alternative where I have downloaded key vault certificate and try to pass in migration script where I have got an error and pfx certificate is not in the coMessage : Certificate /subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Network/applicationGateways/AppGWxxx/sslCertificates/xxx does not have Private Key.
Himanshuk 166 Reputation points

2023-05-31T10:15:40.5333333+00:00

Message : Certificate /subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Network/applicationGateways/AppGWxxx/sslCertificates/xxx does not have Private Key.

This error I am getting while passing downloaded pfx certificate externally, can you please take a look ?
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-05-31T10:44:26.9+00:00

Hello @Himanshuk ,

I’ve reached out to the Application gateway team to understand the PowerShell script that is used for migration and how can we add a manually downloaded certificate from key vault to the migration script. Once I get a response, I will share an update.

Regards,

Gita

Answer 1

GitaraniSharma-MSFT 50,021 Microsoft Employee Moderator

Hello @Himanshuk ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know if it can be provisioned to migrate App gateway v1 to v2 SKU using key vault certificates.

As of today, it is not supported:

enter image description here

Refer: https://learn.microsoft.com/en-us/azure/application-gateway/retirement-faq#does-this-script-support-certificates-uploaded-to-azure-key-vault-

However, I checked with the Azure Application gateway Product Group team, and they mentioned that this is planned as part of script enhancement. I've not received any specific ETA, but it will be available soon.

Also, I would request you to take a look into the Caveats\Limitations of the App gateway migration for the other limitations: https://learn.microsoft.com/en-us/azure/application-gateway/migrate-v1-v2#caveatslimitations

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-05-31T13:45:21.25+00:00
Hello @Himanshuk ,

I understand that when you the download key vault certificate and try to pass the same in migration script, you get the below error: Certificate /subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.Network/applicationGateways/AppGWxxx/sslCertificates/xxx does not have Private Key.

Could you please check the below steps and let me know if it helps:

In Azure Portal, go to your Key Vault and then go to the Certificates pane. Click on the certificate that you are downloading and then click on Issuance Policy:

In the Issuance Policy Window, click on the Advanced Policy Configuration link:

And in the Advanced Policy Configuration window, check if the Exportable Private Key is set to Yes.

As explained in this document, when a Key Vault certificate is created, it can be retrieved from the addressable secret with the private key in either PFX or PEM format. The policy that's used to create the certificate must indicate that the key is exportable. If the policy indicates that the key is non-exportable, then the private key isn't a part of the value when it's retrieved as a secret.

If the Exportable Private Key is set to No in your certificate policy, then please set it to Yes and click OK and save the configuration.

After that try to download the certificate again and try passing this in the migration script.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Himanshuk 166 Reputation points

2023-06-01T07:07:29.12+00:00

As per your message the certificate key is already exported still getting the same issue, actually we have now tried az secret download then getting following error
ErrorRecord :Exception calling ".ctor" with "3" argument(s): "An error occurred during encode or decode operation." how to resolve it ? (note: previously we have tried az certificate download now we replace with az secret download )
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2023-06-01T10:28:38.6066667+00:00
Hello @Himanshuk ,

May I know what certificate are you trying to upload?

Is it for TLS inspection

Or Mutual Authentication.

I see you are using "az secret download".

Is it "az keyvault secret download" command?

Refer : Export stored certificates

Can you please share the screenshot/entire error message when you try to run this command?

Thanks,

Kapil
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2023-06-05T05:55:19.1+00:00

Hello @Himanshuk ,

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil
KapilAnanth-MSFT 49,536 Reputation points Microsoft Employee Moderator

2023-06-07T05:22:27.2966667+00:00
Hello @Himanshuk ,

Reaching out to check if the issue still persists.

For a deeper investigation, we can also have a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue.

If you have a support plan you may file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

In case you need a one-time free technical support could you please send an email to AzCommunity[At]Microsoft[Dot]Com with the below details.

Subject : Attn Kaananth | Azure v1 to v2 migration script not support key vault

Thread URL: Link to this thread.

Subscription ID : Subscription ID of the application gateway

Cheers,

Kapil

Share via

Azure v1 to v2 migration script not support key vault

1 answer

Your answer