Skip to content

Provision certificates to Azure API Management

Provision a certificate from Certificate Manager - SaaS to a custom domain of a Microsoft Azure API Management service. Certificate Manager - SaaS uploads the certificate to the custom domain you choose and leaves the service's other custom domains unchanged.

Before you begin

  • An Azure API Management machine that you created and whose status is Verified.
  • The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • The hostname of the custom domain where you want to install the certificate, and its domain type.

To provision a certificate to Azure API Management

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, in Hostname, enter the custom-domain hostname where you want to install the certificate, for example api.contoso.com. If the service has no custom domain with this hostname and domain type, Certificate Manager - SaaS adds one.

  6. For Domain Type, choose the custom-domain endpoint:

    • Gateway: the API gateway. This is the default.
    • Developer Portal: the developer portal.
    • Management: the management API.
    • Source Control (SCM): the source control endpoint.
    • Configuration API: the configuration API.

  7. For Certificate Source, keep the default, Custom (Uploaded). It's the only source that provisioning uses.

    Note

    The list also offers Azure Key Vault and Built-in, and choosing Azure Key Vault shows Key Vault Secret ID. Provisioning ignores these. Whatever you choose, Certificate Manager - SaaS uploads the certificate as a custom certificate. If the custom domain loaded its certificate from Microsoft Azure Key Vault, Certificate Manager - SaaS removes the Key Vault reference from that custom domain only.

  8. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.

  9. Click Save. To save and then provision another certificate, click Save & New.

After you save, Certificate Manager - SaaS converts the certificate to the format Azure requires and updates the custom domain, and an installation appears on the machine's Installations tab. If another update to the service is in progress, Certificate Manager - SaaS waits and tries again. Azure can take 15 to 30 minutes to finish updating the service. Certificate Manager - SaaS waits up to 60 seconds, and then reports success while Azure finishes the update. To provision on a schedule instead of right away, set up a machine provisioning schedule.