Azure Services Setup for Certificate & Key Discovery
This document outlines how to set up required Azure resources so that the discovery extension can enumerate keys and certificates. Steps are given for both Azure Portal and Azure CLI.
1. Azure App Service (Web Apps with SSL/TLS)
Portal
Go to App Services → Create → choose subscription, resource group, name, runtime, and region.
After deployment, navigate to the app → Custom domains → Add custom domain.
Bind an SSL certificate: Upload certificate under TLS/SSL settings → Private Key Certificates (.pfx). Assign it to your custom domain in Bindings.
CLI
az webapp create \
--resource-group <rg-name> \
--plan <app-service-plan> \
--name <app-name> \
--runtime "PYTHON:3.10"
az webapp config ssl upload \
--resource-group <rg-name> \
--name <app-name> \
--certificate-file <cert.pfx> \
--certificate-password <password>
az webapp config ssl bind \
--resource-group <rg-name> \
--name <app-name> \
--certificate-thumbprint <thumbprint> \
--ssl-type SNI2. Azure Application Gateway (with SSL Certificates)
Portal
Go to Application Gateways → Create.
Select v2 SKU, virtual network, subnet.
Add a listener under Frontend listeners.
Upload certificate in Certificates → associate with listener.
Set Backend pools and Rules.
CLI
az network application-gateway create \
--name <ag-name> \
--resource-group <rg-name> \
--vnet-name <vnet-name> \
--subnet <subnet-name> \
--capacity 2 \
--sku WAF_v2
az network application-gateway ssl-cert create \
--gateway-name <ag-name> \
--resource-group <rg-name> \
--name <cert-name> \
--cert-file <cert.pfx> \
--cert-password <password>
az network application-gateway http-listener create \
--gateway-name <ag-name> \
--resource-group <rg-name> \
--name <listener-name> \
--frontend-ip appGatewayFrontendIP \
--frontend-port <port> \
--ssl-cert <cert-name>3. Azure Front Door (with HTTPS/Certificates)
Portal
Go to Front Doors and CDN profiles → Create → choose SKU (Standard/Premium).
Add a Frontend endpoint with a custom domain.
Under Custom domain HTTPS, enable HTTPS and choose: Azure-managed certificate (default), or Bring-your-own certificate from Azure Key Vault.
CLI
az network front-door create \
--resource-group <rg-name> \
--name <fd-name> \
--backend-address <app-backend>
az network front-door frontend-endpoint enable-https \
--resource-group <rg-name> \
--front-door-name <fd-name> \
--name <frontend-endpoint> \
--certificate-source AzureKeyVault \
--vault-id <kv-resource-id> \
--secret-name <cert-name> \
--secret-version <version>4. Azure API Management (APIM with Certificates)
Portal
Go to API Management Services → Create.
Provide name, region, pricing tier, and virtual network if required.
Under Custom domains, configure a hostname for Gateway, Portal, Management, or SCM.
Upload certificates for each domain.
CLI
az apim create \
--name <apim-name> \
--resource-group <rg-name> \
--location <region> \
--publisher-email <email> \
--publisher-name <name>
az apim update \
--name <apim-name> \
--resource-group <rg-name> \
--set hostnameConfigurations.portal.hostname=<domain> \
hostnameConfigurations.portal.certificateId=<cert-id>5. Azure Key Vault (Keys + Certificates)
Portal
Go to Key Vaults → Create → provide name, region, pricing tier.
Under Certificates, create/import certificates.
Under Keys, generate/import keys.
Ensure Access policies / RBAC grant permissions to your service principal.
CLI
az keyvault create \
--name <kv-name> \
--resource-group <rg-name> \
--location <region>
az keyvault certificate import \
--vault-name <kv-name> \
--name <cert-name> \
--file <cert.pfx> \
--password <password>
az keyvault key create \
--vault-name <kv-name> \
--name <key-name> \
--kty RSA \
--size 2048🔒 Final Checklist
[ ] App Service → uploaded/bound SSL certificate
[ ] Application Gateway → listener bound with SSL certificate
[ ] Front Door → HTTPS enabled with Key Vault or managed cert
[ ] API Management → custom domain with certificate uploaded
[ ] Key Vault → keys and certificates provisioned + access policy for discovery identity