Azure Key Vault application object

Defines the data necessary for Trust Protection Foundation to enroll and provision certificates to the Azure Key Vault. After provisioning, Azure cloud applications use the certificates.

Azure Key Vault

Attribute

Description

Binding Hostnames

UI: Specify Binding Hostname(s)
Required: No

Policy Definable: No. Default: NA

Required if Update Web App is 1. One or more hostnames that clients use to securely connect to the web application via the bound certificate. For a successful provisioning, the values must match a DNS SAN in the certificate.

Binding SSL Type

UI: SSL Type
Required: No

Policy Definable: Yes. Default: 0

Required if Update Web App is 1. Indicates how the Azure web application will manage connections:

  • 0 = for Server Name Indication (SNI) connections.
  • 1 = IP Based client connections.

Certificate Credential

UI: Certificate Credential
Required: Yes

Policy Definable: Yes. Default: NA

The private key credential of the certificate.

Certificate Name

UI: Certificate Name
Required: No

Policy Definable: No. Default: NA

The unique identifier of the certificate from the Azure Key Vault. If the value is empty or invalid, the driver automatically generates and adjusts the value:

  • Use the Certificate Name (CN) from the certificate. If the CN, is empty, use the first DNS SAN.
  • Comply with the Azure Key Vault naming requirements Only allow alphanumeric characters and the hyphen (-).
  • Automatically replace any unsupported special characters, with a hyphen (-). For example, www.venafi.com renames to www-venafi-com.

Client ID

UI: Application ID
Required: Yes

Policy Definable: Yes. Default: NA

The Application ID of the Azure Service Principal.

Create Binding

UI: Create New Binding
Required: No

Policy Definable: Yes. Default: 0

Required if Update Web App is 1. The setting to create a binding:

  • 0 = For update only. Return an error if the binding does not already exist.
  • 1 = Create the specified binding if it does not already exist.

Create SAN DNS Bindings

UI: Create/Update binding for each DNS SAN
Required: No

Policy Definable: Yes. Default: 0

Required if Update Web App is 1. The setting to create hostname binding:

  • 0 = Only create hostname bindings that are specified by Binding Hostnames.
  • 1 = Automatically create hostname bindings for every DNS SAN in the certificate.

Environment

UI: NA
Required: No

Policy Definable: Yes. Default: NA

When set on policy or on the Azure Key Vault application, this attribute can replace the default AzureGlobalCloud with an environment: AzureUSGovernment, AzureChinaCloud, or AzureGermanCloud.

File Validation Disabled

UI: NA
Required: No

Policy Definable: No. Default: 0

The setting to control file validation:

  • 0 = Validate. Authenticate to the managed device using assigned credentials.
  • 1 = Disable validation.

Network Validation Disabled

UI: NA
Required: No

Policy Definable: Yes. Default: 0

The setting for network validation:

  • 0 = Validate by making an SSL/TLS connection to the managed device.
  • 1 = Disable network validation.

Non-Exportable

UI: Private Key Exportable
Required: No

Policy Definable: No. Default: 1

The setting to control private key export:

  • 0 = Export private keys from the Azure Key Vault.
  • 1 = Block private key export.

Timeout

UI: NA
Required: No

Policy Definable: No. Default: 100000

The number of milliseconds for long running interactions with the Azure Client API. For example a value of 100000 is 100 seconds.

Update Web App

UI: Bind Certificate to Web Application
Required: No

Policy Definable: Yes. Default: 0

The setting to provision the certificate to the Azure Key Vault:

  • 0 = Only provision the certificate to Azure Key Vault.

  • 1 = Bind the certificate to the specified web application after it successfully provisions to Azure Key Vault. Also requires:

    •  Web App Name

    • Create SAN DNS Bindings
    • Binding SSL Type
    • Binding Hostnames

Vault Name

UI: Azure Key Vault Name
Required: Yes

Policy Definable: Yes. Default: NA

The vault name as defined in the Azure service portal.

Web App Name

UI: Web Application Name
Required: No

Policy Definable: Yes. Default: NA

Required if Update Web App is 1. The name of the Azure web application that requires binding to the certificate.