Certificate Renewal (PRO)¶
Renew a Key Vault certificate from CertifyClouds, whoever issues it. The new version replaces the current one in Key Vault, reaches the copies CertifyClouds manages, and the old version stays on for a grace period, or for as long as something still points at it by its version number.
Starting a renewal¶
Open the certificate's page and choose Renew certificate. What happens depends on who issues the certificate:
| Issuer | What renewal does |
|---|---|
| Self-signed by Key Vault | Key Vault creates a new self-signed version with the same settings |
| A certificate authority connected to Key Vault (for example DigiCert or GlobalSign) | Key Vault places a new order with that CA. It is usually a paid order, so you tick a box to confirm it first. A second order for the same certificate within 24 hours needs its own confirmation |
| Any other certificate authority | Three steps: CertifyClouds creates a certificate request, you send it to your CA, then you upload the signed certificate they return |
Before anything changes, the dialog shows:
- which version the new one replaces;
- how many managed copies will receive the new version;
- any app or service that points at the current version by its version number (a pinned reference). These keep using the old version, so update them before you turn it off;
- how long the old version stays on after renewal;
- whether rollback is available. It is not when the certificate's private key cannot be exported.
Your apps and endpoints keep using the current version until the new one is ready.
Renewing with any other certificate authority¶
- Create request. Key Vault makes a new private key and a certificate request (
.csr). The private key never leaves Key Vault. - Send it to your CA. Download the request and give it to your CA, or to whoever looks after your certificates. They only need the request, never a private key.
- Upload the signed certificate. Upload the
.crt,.ceror.pemfile your CA sends back, or paste its text. If your CA sent intermediate certificates as a separate file (a chain or bundle), add them too. CertifyClouds checks that the certificate matches the request before it changes anything.
You can stop after any step and come back later. The certificate's Renewals tab shows Waiting for signed certificate until you upload it.
Following a renewal¶
The certificate's Renewals tab lists the renewals started from CertifyClouds and where each one stands. Renewals Key Vault carries out by itself show in the certificate's History.
- Waiting for CA: the CA is issuing the certificate. CertifyClouds checks for it and emails you when it arrives.
- Waiting for signed certificate: upload the certificate your CA sent.
- Completed: the new version is current. The old version stays on for the grace period, or until you turn it off if a pinned reference still uses it.
Turn off old version switches it off straight away. If pinned references still use it, you confirm that they will stop working first.
You can cancel a renewal until the CA has issued the certificate. After it completes, Roll back makes the previous version current again. Rollback is not offered when the certificate's private key cannot be exported.
App Registration certificates¶
A certificate an App Registration signs in with renews through its rotation, not from the certificate's page, so that Key Vault and the App Registration always change together. See CA-issued certificates in Secret Rotation.
Requirements¶
- PRO or ENTERPRISE.
- CertifyClouds needs to create and update certificates in the vault. See Azure Permissions.
- A CA connected to Key Vault must already be set up as an issuer in that vault. CertifyClouds uses the issuer; it does not create one.