{"id":12158,"date":"2026-04-12T19:57:00","date_gmt":"2026-04-13T00:57:00","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=12158"},"modified":"2026-04-30T12:59:37","modified_gmt":"2026-04-30T17:59:37","slug":"venafi-trust-protect-and-azure-key-vault-integration","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=12158","title":{"rendered":"Venafi Trust Protect and Azure Key Vault Integration"},"content":{"rendered":"

Entra App Registration<\/h3>\n

Add a new Entra App registration for Venafi<\/p>\n

<\/p>\n

There is no redirect URI needed for this registration<\/p>\n

<\/p>\n

In this example, my App ID is 05151153-f5d5-4ce8-94cb-9086d70d3c05<\/p>\n

On app, go to certificates & secrets. Upload PUBLIC key of a Digital Signature certificate.<\/p>\n

<\/p>\n

Confirm the public key has been added<\/p>\n

<\/p>\n

Key Vault Configuration<\/h3>\n

In the Azure Portal, navigate to the Key Vaults<\/p>\n

<\/p>\n

Confirm you have an appropriate key vault, or create one. In this example, I am creating a new key vault.<\/p>\n

<\/p>\n

Select the subscription and resource group to be used, provide a name for the vault.<\/p>\n

<\/p>\n

In this example, my key vault is LJRVenafiTestKeyVault<\/p>\n

<\/p>\n

This vault uses RBAC access. Click on \u201cAccess control (IAM)\u201d to add rights for the Entra app to use this key vault<\/p>\n

<\/p>\n

Select \u201cAdd role assignment\u201d<\/p>\n

<\/p>\n

Select the \u201cKey Vault Certificates Officer\u201d role<\/p>\n

<\/p>\n

Add the application name to this role:<\/p>\n

<\/p>\n

Venafi Configuration<\/h3>\n

Now, in Venafi, we can add an Azure Key Vault installation to a certificate.<\/p>\n

First, we need to create a new certificate type credential to hold the private key for the certificate used in the app registration<\/p>\n

<\/p>\n

Upload the certificate pfx file and supply the pfx password<\/p>\n

<\/p>\n

Navigate to the certificate you want published into the Azure Key Vault. From the \u201cActions\u201d menu, select \u201cAdd Installation\u201d<\/p>\n

<\/p>\n

Select \u201cTrack, validate, and automate installation of this certificate\u201d<\/p>\n

<\/p>\n

Select a device and chose the \u201cAzure Key Vault\u201d installation type:<\/p>\n

<\/p>\n

The first half of the form does not need to be changed, although you can add a description explaining what the deployment is.<\/p>\n

<\/p>\n

Select the device credential for the host. The \u201cApplication ID\u201d is the Azure App ID from the registered application. The Certificate Credential is the Digital Signature private key uploaded for application authentication.<\/p>\n

The Azure Key Vault Name is the name of the key vault created in Azure, and Certificate Name is the \u201cfriendly\u201d name to be used in the certificate file deployed to the server. This often needs to be included in the application configuration (use this keystore file and<\/em> use this certificate from the keystore). Because I am using this key in a release pipeline, I do not want to bind the certificate to a web service<\/p>\n

<\/p>\n

The cert will be queued for installation into the Azure Key Vault<\/p>\n

<\/p>\n

Once the installation has completed, return to the Azure Portal to confirm that the certificate is now present in the key vault.<\/p>\n

<\/p>\n

Using the Key in a Pipeline<\/h2>\n

This document assumes:<\/p>\n

Azure CLI is installed (https:\/\/learn.microsoft.com\/en-us\/cli\/azure\/install-azure-cli-linux<\/a>)<\/p>\n

You already have an agent pool with online agent in a deployment pool<\/p>\n

<\/p>\n

And, finally, that you have a pipeline deployment that uses a static keystore. We will be replacing that static keystore file with one obtained from the Azure Key Vault.<\/p>\n

First, ensure the Azure DevOps service connection<\/strong> used by the pipeline has access to LJRVenafiTestKeyVault with at least:<\/p>\n