Generate CSR for EIDAS certificate in key vault premium HSM with Organization Identifier (OID 2.5.4.97)

Question

Hello,

I do need to generate on my Premium Key Vault a CSR for a EIDAS Certificate. It's a certificate with "OI" in subject, for Organization Identifier (something in the pattern of "NTRFR-123456789").

I've tried

CN=api.contoso.com,O=Contoso, Ltd.,OU=Cloud Services,L=New York,S=NY,C=US,OI=NTRFR-123456789

and

CN=api.contoso.com,O=Contoso, Ltd.,OU=Cloud Services,L=New York,S=NY,C=US,2.5.4.97=NTRFR-123456789

But both are failing to generate the CSR.

Thank for your help !

Answer 1

I'm surprised I'm the first customer to have the issue, eIDAS certificate are not unusual.

I'm not sure to fully understand the alternative approach ? Is there a way to get HSM certificate with eIDAS compliance ?

Answer 2

Hello François,

Greetings! Thanks for raising this question in Q&A forum.

This issue is most likely happening because Azure Key Vault does not fully support custom X.500 subject attributes like “OI” (OID 2.5.4.97) in the CSR subject field. That’s why both formats you tried are failing during CSR generation.

To resolve this, you can follow these workable options:

Try using only standard supported subject fields Azure Key Vault CSR generation supports common attributes like CN, O, OU, L, S, and C. Remove the OI / 2.5.4.97 field and confirm CSR generation works first.

If eIDAS requires Organization Identifier (OID 2.5.4.97) Generate the CSR outside Azure Key Vault using tools like OpenSSL where custom OIDs are allowed. Then:

• Submit the CSR to your CA
  • After getting the signed certificate, import it into Key Vault using “Import certificate”
  Alternative approach (if HSM is mandatory)

  - Use Key Vault only for key storage (HSM protection)
  
     - Generate CSR through an external process/tool that supports custom OIDs
  
        - Ensure the CA workflow matches your compliance requirement (eIDAS)
  

1. Validate certificate policy limits Key Vault uses a predefined certificate policy model and does not allow arbitrary RDN/OID extensions in subject DN, which is a current platform limitation.

At this point, there is no direct way to include OI (2.5.4.97) in CSR generated from Key Vault itself, so this limitation would require either:

• Using an external CSR generation process, or
• Raising a feature request with Microsoft if this is critical for your use case.

Next action: You (customer) will need to switch to external CSR generation or submit a feature request, as this is a product limitation rather than a configuration issue.

If this answer helps you kindly accept the answer which will help others who have similar questions

Best Regards,

Jerald Felix.