Tutorial: Configure certificates for your Azure Stack Edge Pro with GPU

Article
11/08/2022

This tutorial describes how you can configure certificates for your Azure Stack Edge Pro device with an onboard GPU by using the local web UI.

This tutorial describes how you can configure certificates for your 2-node Azure Stack Edge Pro GPU device by using the local web UI.

The time taken for this step can vary depending on the specific option you choose and how the certificate flow is established in your environment.

In this tutorial, you learn about:

Prerequisites
Configure certificates for the physical device

Prerequisites

Before you configure and set up your Azure Stack Edge Pro device with GPU, make sure that:

You've installed the physical device as detailed in Install Azure Stack Edge Pro GPU.
If you plan to bring your own certificates:
- You should have your certificates ready in the appropriate format including the signing chain certificate. For details on certificate, go to Manage certificates
- If your device is deployed in Azure Government and not deployed in Azure public cloud, a signing chain certificate is required before you can activate your device. For details on certificate, go to Manage certificates.

Configure certificates for device

Open the Certificates page in the local web UI of your device. This page will display the certificates available on your device. The device is shipped with self-signed certificates, also referred to as the device certificates. You can also bring your own certificates.
If you didn't change the device name or DNS domain when you configured device settings earlier, and you don't want to use your own certificates, you don't need any configuration on this page. You just need to verify that the status of all the certificates shows as valid on this page.

You're ready to Activate your device with the existing device certificates.
Follow these steps only if you've changed the device name or the DNS domain for your device. In these instances, the status of your device certificates will be Not valid. That's because the device name and DNS domain in the certificates' subject name and subject alternative settings are out of date.

Select a certificate to view status details.
If you've changed the device name or DNS domain of your device, and you don't provide new certificates, activation of the device will be blocked. To use a new set of certificates on your device, choose one of the following options:
- Generate all the device certificates. Select this option, and then complete the steps in Generate device certificates, if you plan to use automatically generated device certificates and need to generate new device certificates. You should only use these device certificates for testing, not with production workloads.
- Bring your own certificates. Select this option, and then do the steps in Bring your own certificates, if you want to use your own signed endpoint certificates and the corresponding signing chains. We recommend that you always bring your own certificates for production workloads.
- You can choose to bring some of your own certificates and generate some device certificates. The Generate all the device certificates option only regenerates the device certificates.
When you have a full set of valid certificates for your device, the device is ready for activation. Select < Back to Get started to proceed to the next deployment step, Activate your device.

Open the Certificates page in the local web UI of your device. This page will display the certificates available on your device. The device is shipped with self-signed certificates, also referred to as the device certificates. You can also bring your own certificates.
If you didn't change the device name or DNS domain when you configured device settings earlier, and you don't want to use your own certificates, you don't need any configuration on this page. You just need to verify that the status of all the certificates shows as valid on this page.

You're ready to Activate your device with the existing device certificates.
Follow these steps only if you've changed the device name or the DNS domain for your device. In these instances, the status of your device certificates will be Not valid. That's because the device name and DNS domain in the certificates' subject name and subject alternative settings are out of date.

Select a certificate to view status details.
If you've changed the device name or DNS domain of your device, and you don't provide new certificates, activation of the device will be blocked. To use a new set of certificates on your device, choose one of the following options:
- Generate all the device certificates. Select this option, and then complete the steps in Generate device certificates, if you plan to use automatically generated device certificates and need to generate new device certificates. You should only use these device certificates for testing, not with production workloads.
- Bring your own certificates. Select this option, and then do the steps in Bring your own certificates, if you want to use your own signed endpoint certificates and the corresponding signing chains. We recommend that you always bring your own certificates for production workloads.
- You can choose to bring some of your own certificates and generate some device certificates. The Generate all the device certificates option only regenerates the device certificates.
When you have a full set of valid certificates for your device, the device is ready for activation. Select < Back to Get started to proceed to the next deployment step, Activate your device.

Generate device certificates

Follow these steps to generate device certificates.

Use these steps to regenerate and download the Azure Stack Edge Pro GPU device certificates:

In the local UI of your device, go to Configuration > Certificates. Select Generate certificates.
In the Generate device certificates, select Generate.

The device certificates are now generated and applied. It takes a few minutes to generate and apply the certificates.

Important

While the certificate generation operation is in progress, do not bring your own certificates and try to add those via the + Add certificate option.

You are notified when the operation is successfully completed. To avoid any potential cache issues, restart your browser.
After the certificates are generated:
- The status of all the certificates shows as Valid.
- You can select a specific certificate name, and view the certificate details.
- The Download column is now populated. This column has links to download the regenerated certificates.
Select the download link for a certificate and when prompted, save the certificate.
Repeat this process for all the certificates that you wish to download.

In the local UI of your device, go to Configuration > Certificates. Select Generate certificates.
In the Generate device certificates, select Generate.

The device certificates are now generated and applied. It takes a few minutes to generate and apply the certificates.

Important

While the certificate generation operation is in progress, do not bring your own certificates and try to add those via the + Add certificate option.

You are notified when the operation is successfully completed. To avoid any potential cache issues, restart your browser.
After the certificates are generated:
- The status of all the certificates shows as Valid.
- You can select a specific certificate name, and view the certificate details.
- The Download column is now populated. This column has links to download the regenerated certificates.
Select the download link for a certificate and when prompted, save the certificate.
Repeat this process for all the certificates that you wish to download.

The device generated certificates are saved as DER certificates with the following name format:

<Device name>_<Endpoint name>.cer

These certificates contain the public key for the corresponding certificates installed on the device.

You will need to install these certificates on the client system that you are using to access the endpoints on the Azure Stack Edge device. These certificates establish trust between the client and the device.

To import and install these certificates on the client that you are using to access the device, follow the steps in Import certificates on the clients accessing your Azure Stack Edge Pro GPU device.

If using Azure Storage Explorer, you will need to install certificates on your client in PEM format and you will need to convert the device generated certificates into PEM format.

Important

The download link is only available for the device generated certificates and not if you bring your own certificates.
You can decide to have a mix of device generated certificates and bring your own certificates as long as other certificate requirements are met. For more information, go to Certificate requirements.

Bring your own certificates

You can bring your own certificates.

Start by understanding the Types of certificates that can be used with your Azure Stack Edge device.
Next, review the Certificate requirements for each type of certificate.
You can then Create your certificates via Azure PowerShell or Create your certificates via Readiness Checker tool.
Finally, Convert the certificates to appropriate format so that they are ready to upload on to your device.

Follow these steps to upload your own certificates including the signing chain.

To upload certificate, on the Certificate page, select + Add certificate.
You can skip this step if you included all certificates in the certificate path when you exported certificates in .pfx format. If you didn't include all certificates in your export, upload the signing chain, and then select Validate & add. You need to do this before you upload your other certificates.

In some cases, you may want to bring a signing chain alone for other purposes - for example, to connect to your update server for Windows Server Update Services (WSUS).
Upload other certificates. For example, you can upload the Azure Resource Manager and Blob storage endpoint certificates.

You can also upload the local web UI certificate. After you upload this certificate, you will be required to start your browser and clear the cache. You will then need to connect to the device local web UI.

You can also upload the node certificate.

At any time, you can select a certificate and view the details to ensure that these match with the certificate that you uploaded.

The certificate page should update to reflect the newly added certificates.

Note

Except for Azure public cloud, signing chain certificates are needed to be brought in before activation for all cloud configurations (Azure Government or Azure Stack).