Add certificates using the Azure CLI

You can use Azure Key Vault (AKV) to store SSL/TLS certificates and keys to use in your NGINXaaS configuration.

Prerequisites

AKV to store certificates that you want to add to the deployment.

Note:
The Key Vault firewall should remain in the default “disabled” state.

A user or system assigned identity associated with your NGINXaaS deployment. Ensure that your managed identity (MI) has read access to secrets stored in AKV:
- If using Azure RBAC for AKV, ensure that your MI has Key Vault Secrets User or higher permissions.
- If using Access Policies for AKV, ensure that your MI has GET secrets or higher permissions.
In addition to the MI permissions, if using the Azure portal to manage certificates, ensure that you have the following permissions:
- Key Vault Reader or higher permission to view the Key Vault resource.
- Read access to list certificates inside the Key Vault:
  - If using Azure RBAC for AKV, ensure that you have Key Vault Reader or higher permissions.
  - If using Access Policies for AKV, ensure that you have GET certificates or higher permissions.
If you’re unfamiliar with Azure Key Vault, check out the Azure Key Vault concepts documentation from Microsoft.

Confirm that you meet the NGINXaaS Prerequisites.
Install Azure CLI version 2.59.0 or greater: Azure CLI Installation.
Log into your Azure account through the CLI: Azure CLI Authentication.
Install the NGINXaaS for Azure extension:

Note:
The extension will automatically install the first time you run an az nginx command.
```
az extension add --name nginx
```

See Also:
See the NGINXaaS for Azure CLI reference for a complete list of NGINXaaS CLI commands.

Create a certificate

Create a certificate under a deployment. This references an existing certificate in an Azure Key Vault and makes it available to NGINX configuration

To create a certificate, use the az nginx deployment certificate create command:

az nginx deployment certificate create --certificate-name
                                       --deployment-name
                                       --resource-group
                                       [--certificate-path]
                                       [--key-path]
                                       [--key-vault-secret-id]
                                       [--location]
                                       [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]

Example

Create a certificate with a certificate path, key path, and key vault secret ID:

az nginx deployment certificate create --certificate-name myCertificate \
   --deployment-name myDeployment --resource-group myResourceGroup \
   --certificate-path /etc/nginx/test.cert --key-path /etc/nginx/test.key \
   --key-vault-secret-id keyVaultSecretId

See Azure CLI Certificate Create Documentation for more details on the available parameters.

Update a certificate

To update a certificate, use the az nginx deployment certificate update command:

az nginx deployment certificate update [--add]
                                       [--certificate-name]
                                       [--certificate-path]
                                       [--deployment-name]
                                       [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                                       [--ids]
                                       [--key-path]
                                       [--key-vault-secret-id]
                                       [--location]
                                       [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                       [--remove]
                                       [--resource-group]
                                       [--set]
                                       [--subscription]

Example

Update the certificate virtual path, key virtual path and certificate:

az nginx deployment certificate update --certificate-name myCertificate \
   --deployment-name myDeployment --resource-group myResourceGroup \
   --certificate-path /etc/nginx/testupdated.cert \
   --key-path /etc/nginx/testupdated.key \
   --key-vault-secret-id newKeyVaultSecretId

See Azure CLI Certificate Create Documentation for more details on the available parameters.

Delete a certificate

To delete a certificate, use the az nginx deployment certificate delete command:

az nginx deployment certificate delete [--certificate-name]
                                       [--deployment-name]
                                       [--ids]
                                       [--no-wait {0, 1, f, false, n, no, t, true, y, yes}]
                                       [--resource-group]
                                       [--subscription]
                                       [--yes]

Example

Delete a certificate:

az nginx deployment certificate delete --certificate-name myCertificate \
   --deployment-name myDeployment --resource-group myResourceGroup

See Azure CLI Certificate Delete Documentation for more details on the available parameters.