Application Gateway don't able to use Key vault Certificate

Question

Hi, I'm trying to use a certificate generated by key vault in one of my listeners, the problem is that when I add it and click on save, I get a notification saying:
Failed to save configuration changes to application gateway 'XXXXX'. Error: Problem occured while accessing and validating KeyVault Secrets associated with Application Gateway

I checked and the Managed Identity has all the access policies allowed in the key vault, and is used by the Listener TLS Certificate.

Which could be the problem?
Thanks.

Answer 1

Hello @Luca Sosa

Ok try these 3 points and if you still face issues lets schedule it

CERTIFICATE CREATION

In the Advanced Policy menu add these Flags and select 4096 for Key Size :

Finally the User Assigned Managed Identity :

Kindly mark the answer as Accepted and Upvote !

Regards

Answer 2

Hello @Luca Sosa !

Welcome to Microsoft QnA!

First have a look here :

https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-key-vault-common-errors

Next add the Certificate Policies to the managed identity not only the Secrets

Verify that access to Key Vault is permitted from Network or no other blocks are there

Try these and tell me how it went !

--

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Answer 3

Hello @Luca Sosa

Thamks for the Input , ignore previous post ...lets solve this issue !

Kindly let me know :

Application Gateway uses a managed identity to retrieve certificates from Key Vault on your behalf.

You can either create a new user-assigned managed identity or reuse an existing with the integration. To create a new user-assigned managed identity, see Create a user-assigned managed identity using the Azure portal.

Have you seen this :

https://learn.microsoft.com/en-us/azure/application-gateway/key-vault-certs#how-integration-works

....If you're using the permission model Vault access policy: Select Access Policies, select + Add Access Policy, select Get for Secret permissions, and choose your user-assigned managed identity for Select principal. Then select Save....

ALSO

As of March 15, 2021, Key Vault recognizes Application Gateway as a trusted service by leveraging User Managed Identities for authentication to Azure Key Vault. With the use of service endpoints and enabling the trusted services option for Key Vault's firewall, you can build a secure network boundary in Azure. You can deny access to traffic from all networks (including internet traffic) to Key Vault but still make Key Vault accessible for an Application Gateway resource under your subscription.

When you're using a restricted Key Vault, use the following steps to configure Application Gateway to use firewalls and virtual networks:....rest on the LINK

--

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Answer 4

Hello @Luca Sosa

Yes since you Generate a certificate you ahev to confgure the issuance policy

https://learn.microsoft.com/en-us/azure/application-gateway/configure-key-vault-portal

Also is the app gateway V2 ?

Create Certificate and Issuance Policy

Certificate

1. In the Key Vault that was created earlier, navigate to Certificate.
2. Under Certificate select your desired method of creation, whether you want to Import or Generate. If you choose to generate the certificate, you would need to create the issuance policy.
3. Input your Certificate name and complete all the required fields.
4. After providing the information above, select Create.

Also you have to enter P12 not PEM for the Certificate

Please review the steps in the link and configure the issuance Policy and select P12 [PFX[ not PEM

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards