Skip to content

Create an Azure API Management machine

Create a Microsoft Azure API Management machine so Certificate Manager - SaaS can discover the certificates on the custom domains of an API Management service and provision certificates to them. The connector runs in the cloud and signs in to Azure as a Microsoft Entra ID service principal, so no VSatellite is needed.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • The subscription ID, resource group name, and service name of the API Management service.
  • A Microsoft Entra ID service principal that authenticates with a client secret, and its tenant ID, application (client) ID, and client secret. Azure managed identities aren't supported.
  • A role assignment for the service principal, on the API Management service or its resource group, that grants read and write access to the service. The built-in API Management Service Contributor role grants both. Discovery needs the read access, and provisioning needs the write access.
  • Network access from Certificate Manager - SaaS to each custom-domain hostname of the service on port 443, so that discovery can read the certificate each hostname serves.

To create an Azure API Management machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Azure API Management.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.
  6. In Tenant ID, enter the ID of the Microsoft Entra ID tenant that holds the service principal. You can also enter the tenant's domain, for example contoso.onmicrosoft.com.
  7. In Client ID, enter the application (client) ID of the service principal.

  8. In Client Secret, enter the client secret of the service principal.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  9. In Subscription ID, enter the ID of the Azure subscription that contains the API Management service.

  10. In Resource Group, enter the name of the resource group that contains the API Management service.
  11. In Service Name, enter the name of the API Management service.

  12. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that the service principal can sign in and read the API Management service. The test also fails if the service's provisioning state isn't Succeeded, for example while Azure is still updating the service. It doesn't confirm that the service principal has write access, which provisioning needs.

  13. (Optional) To skip certificates that have already expired, enable Exclude Expired Certificates.

    Discovery reads the custom domains of the API Management service. To read each certificate, Certificate Manager - SaaS connects to the custom-domain hostname on port 443, and it skips any hostname it can't reach. Certificates that Azure manages for free (managed certificates) aren't discovered. Discovery also finds certificates that the service loads from Microsoft Azure Key Vault and flags them as Key Vault certificates.

  14. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  15. Click Continue. The Provisioning step opens.

  16. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  17. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates on your custom domains.