Please refer to this blog post for details.
Clone this repo and then cd KeyVaultCA
- Create Azure KeyVault:
az keyvault create --name <KEYVAULT_NAME> \
--resource-group keyvault-ca \
--enable-soft-delete=true \
--enable-purge-protection=true
-
Create a Service Principal in AAD
az ad sp create-for-rbac --name api-facade-for-keyvault-ca --skip-assignment=true
You will get an output containingappId
andpassword
, please note them for later. -
Give the Service Principal accesss to KeyVault keys and certificates:
az keyvault set-policy --name <KEYVAULT_NAME> \
--spn <your appId> \
--key-permissions sign \
--certificate-permissions get list update create
- Run the API Facade like this (feel free to use your own values for the subject):
dotnet run --appId <YOUR_APPID> --secret <YOUR_APP_SECRET> \
--ca --subject="C=US, ST=WA, L=Redmond, O=Contoso, OU=Contoso HR, CN=Contoso Inc" \
--issuercert ContosoRootCA --kvName <KEYVAULT_NAME>
-
First generate the private key:
openssl genrsa -out mydevice.key 2048
-
Create the CSR:
openssl req -new -key mydevice.key -out mydevice.csr
openssl req -in mydevice.csr -out mydevice.csr.der -outform DER
-
Run the API Facade and pass all required arguments:
dotnet run --appId <YOUR_APPID> --secret <YOUR_APP_SECRET> \
--issuercert ContosoRootCA --csrPath <PATH_TO_CSR_IN_DER_FORMAT> \
--output <OUTPUT_CERTIFICATE_FILENAME> --kvName <KEYVAULT_NAME>