How to Reuse Key on Renewal for imported certificates in AKV

Question

Hi,

I met a problem when I tried to config Reuse Key on Renewal for my cert in AKV:

I have 2 certs A and B. I download PEM file from A, and import the PEM file to B for B's new version. I found that every time after I import to create a new version in B, cert B's policy will be reset, e.g. Type of CA will be non-integrated CA, and Advanced Plicy Conifguration will be Not Configured.

So I want to understand:

1. if B's current version is created by 'import', is it feasible to reuse key on renewal? If it can be done, what are the exact steps?
2. if 1 is not feasible, do I have to manually set B's policy, e.g. Type of CA to be integrated CA, lifetime action as auto renew, and configured as 'Reuse Key on Renewal', then create a new version by generate. After that, all new generated version will reuse same key?

Please advice. Thanks a lot.

Answer 1

@Yi Zhou

Thank you for posting your query on Microsoft Q&A, from above description I could understand that you are looking for advisory on if you could use key value pair of one certificate to renew another self imported certificate.

Please do correct me if this is not the case by responding in the comments section.

A certificate is a versioned object. If the current version is expiring, you need to create a new version. Conceptually, each new version is a new certificate that's composed of a key and a blob that ties that key to an identity. When you use a nonpartnered CA, the key vault generates a key/value pair and returns a certificate signing request (CSR).

Each new CSR that you create has a private key, which has to match when you merge the signed request. Hence, it's important to merge the signed CSR with the same CSR request that you created. Otherwise, the key won't match.

So the answer to your question would be the 2nd option you mentioned i.e., manually set B's policy, e.g. Type of CA to be integrated CA, lifetime action as auto renew, and configured as 'Reuse Key on Renewal', then create a new version by generate.

Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik

Answer 2

Hello Yi Zhou,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

Sequel to your scenarios and questions, I understand that you encountered issues with maintaining consistent policies and configurations, specifically regarding certificate renewal and key reuse when importing certificates.

To address each question, I broke them down into three sections with clear steps and explanations:

1. Feasibility of Key Reuse on Renewal: After importing a PEM file to create a new version of certificate B, it is indeed feasible to configure key reuse on renewal. The process involves setting the appropriate policies within Azure Key Vault. Here's how to do it:
   1. Navigate to Azure Key Vault: Go to the Azure portal and locate your Azure Key Vault instance.
   2. Select Certificate B: Click on the certificate B for which you imported the PEM file to create a new version.
   3. Configure Policies:
      1. Type of CA: Ensure that the type of CA is set to your desired configuration. If you prefer an integrated CA, select that option.
      2. Lifetime Action: Set the lifetime action to auto-renew if you want the certificate to automatically renew upon expiration.
      3. Key Reuse on Renewal: Enable the option to reuse the key on renewal. This ensures that the same key is used for subsequent certificate renewals.
      4. Save Changes: Once you've configured the policies according to your requirements, save the changes.
2. Manual Configuration of Certificate Policies: If key reuse on renewal isn't feasible directly after importing the PEM file, you can manually configure certificate B's policies to ensure consistent configurations for future versions. Here are the steps:
   1. Navigate to Azure Key Vault: Access your Azure Key Vault instance in the Azure portal. Select Certificate B: Locate and select certificate B.
   2. Manually Configure Policies:
      1. Type of CA: Set the type of CA to your preferred configuration, such as integrated CA. Lifetime Action: Configure the lifetime action to auto-renew if desired.
      2. Key Reuse on Renewal: Enable the option to reuse the key on renewal to ensure consistency in key usage across versions.
      3. Generate New Version: Once you've manually configured the policies, generate a new version of certificate B. This ensures that future versions will inherit the configured policies.
3. Ensuring Consistency Across Versions:

To ensure that imported certificates maintain consistent policies and configurations across versions in Azure Key Vault, follow these best practices:

1. Document Policies: Clearly document the desired policies and configurations for your certificates, including CA type, lifetime action, and key reuse preferences.
2. Regular Review: Periodically review the policies and configurations of your certificates in Azure Key Vault to ensure they align with your documented preferences.
3. Automate Processes: Utilize automation tools or scripts to automate certificate management tasks, such as setting policies and generating new versions, to reduce the risk of manual errors and inconsistencies.

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Best Regards,

Sina Salam