3

I would like to create a self signed CA certificate via Azure portal (Azure Key Vault). I am not sure how to set X509 extension Basic Constraints CA:True

Some reference link: https://learn.microsoft.com/en-us/powershell/module/pkiclient/new-selfsignedcertificate?view=win10-ps

https://www.alvestrand.no/objectid/2.5.29.19.html

(Note: I need to do it manually via Azure Portal, not the openssl or PowerShell script)

How I tried to do

enter image description here

And what I get enter image description here

My expectation is CA:True. Thank you for your helps :)

1 Answer 1

6

Apparently this works though the REST API, but is unfortunately neither exposed through the Portal UI nor through the .NET Client SDK. Also, it's not properly documented right now.

When you look at the example response for the Get Certificate Policy endpoint, you can see that it has a section "basic_constraints" with the value you're looking for (even though it's not documented in the respective X509CertificateProperties section further down on the same page).

The property is however documented in the general "D509 props" documentation for the REST API. Mind the typo in path_len_contraint though if you want to use that -- needs to be path_len_constraint.

So when POSTing to https://<yourvault>.vault.azure.net/certificates/some-new-cert/create?api-version=7.0 using

    "x509_props": {
        ...
        "key_usage": [
            "keyCertSign"
        ],
        "basic_constraints": {
            "ca": true,
            "path_len_constraint": 3
        }
    },

it actually sets the values as expected. See Create Certificate documentation for other parameters.

The result can be seen in the openssl dump of the exported certificate:

        X509v3 Key Usage: critical
            Certificate Sign
        X509v3 Basic Constraints: critical
            CA:TRUE, pathlen:3
3

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.