Loading X509Certificate from Azure KeyVault

Question

We have a web application hosted in Azure that we use to load certificates from KeyVault to be used for encryption and authentication with other services. After reading the value from KeyVault, we're creating the certificate like this:

return new X509Certificate2(Convert.FromBase64String(secret.Value), string.Empty,
                    X509KeyStorageFlags.MachineKeySet |
                    X509KeyStorageFlags.PersistKeySet |
                    X509KeyStorageFlags.Exportable);

We've been seeing a lot of errors about "Keyset does not exist" and "The request was aborted: Could not create SSL/TLS secure channel".

I suspect this is because it's persisting the private key to disk (C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys), which is causing an issue when trying to read it again, since it's a shared hosting environment and we don't fully own the machine.

Is there a proper way to do this? I've seen references to using the certificate store, but I'm not too sure how that ties in with getting the certificate from KeyVault.

Answer 1

I think a better solution is to use Managed Service Identity(MSI) if applicable. The MSI feature will create a service principal in Azure AD to represent the identity of the service/VM. And assign this service principal property role or permission in the key-vault, which can be done via creating a new access policy in the "Setting -> Access policies" section in key-vault. The service principal should be same as the service name. This name can be different if create via powershell.

After the MSI setting, a cert or secret can be uploaded into key-vault and accessed in the service.

Answer 2

Is there a proper way to do this? I've seen references to using the certificate store, but I'm not too sure how that ties in with getting the certificate from KeyVault.

In your case, it seems that you just load the cert from keyvault, but the certificate is not deployed to the Azure WebApp. About how to deploy Azure Web App Certificate through Key Vault, you could get the detail steps from this blog .

The easiest way using the cert in the Azure WebApp is that you could upload the pfx file to the Azure WebApp from Azure portal and add an app setting called WEBSITE_LOAD_CERTIFICATES and set its value to the thumbprint of the certificate. But there is no relationship with KeyVault .