Key Vault Keys vs Secrets

Question

We have a master key vault which should contain the certificates to authenticate to certain service principals (1 SP per environment). These service principals have access to their personal Key Vault. We used secrets to store the certificates. However it seems like 'keys' are a better fit to store certificates, because keys can generate certificate by themself. Is that correct?

For now, our VSTS service principal deploys an ARM template, and puts the correct certificate in the certificate store of the web app service. This certificate is then used to authenticate the application as the SP and allow it to retrieve the secrets from the SP personals Key vault.

I was able to add the certificate (as secret) like this:

{
     "type":"Microsoft.Web/certificates",
     "name":"testCertificate",
     "apiVersion":"2016-03-01",
     "location":"[resourceGroup().location]",
     "properties":{
        "keyVaultId":"/subscriptions/xxxx/resourceGroups/rg/providers/Microsoft.KeyVault/vaults/xxxx",
        "keyVaultSecretName":"testcert",
        "serverFarmId":"[resourceId('Microsoft.Web/serverfarms', 'asp-test1')]"
}

Is it possible to add the certificate via a 'key' instead of a 'secret'? How can I map the key with the ARM template?

4c74356b41 4c74356b41 · Accepted Answer · 2017-02-10T08:16:43

I don't think its possible right now, looking at the ARM Schema I can't seem to find a way to create a Key with the ARM Template, and I don't see a way to reference a key in the WebApp deployment either.

Also, the article I've linked you in my previous answer clearly states that you need to use secrets (look for this string at the bottom of the article):

Create a self-signed certificate and authorize it to read Key Vault Secrets as described here

Link: https://blogs.msdn.microsoft.com/appserviceteam/2016/05/24/deploying-azure-web-app-certificate-through-key-vault/

Key Vault Keys vs Secrets

1 Answers