Microsoft onprem PKI to Azure

Azure native services do not allow for direct replacement of Active Directory Certificate Services (AD CS) for full-scale, on-premises certificate authority (CA) management, especially when it comes to custom certificate templates (used for things like NGINX, IIS, etc.). However, you can integrate Azure with on-premises AD CS in a hybrid setup, where AD CS continues to issue certificates (including custom templates) and Azure can manage key storage and related security tasks.

You can provide some PKI-related functionality by using Azure Key Vault (managing certificates). While Azure Key Vault does not act as a certificate authority (CA), it can be used for managing certificates. Key Vault can store, manage, and automate the renewal of certificates issued by a third-party CA or your on-premises AD CS. You can store certificates used by NGINX, IIS, or any other web servers in Key Vault, and use its secure storage features.

More specifically, it does offer the following features:

• Certificate storage: Once you issue certificates through AD CS or a third-party CA, you can securely store them in Azure Key Vault.
• Automated certificate renewal: If you are using public certificates (e.g., from Let’s Encrypt), Key Vault can help automate certificate renewal and integrate with your services.
• Access management: Azure Key Vault ensures that only authorized users or applications can access the stored certificates.

If you're looking for a cloud-native certificate management solution that allows custom certificate templates and lifecycle management, you might want to consider using a third-party CA integrated with Azure, such as DigiCert, GlobalSign, or Sectigo. These services provide a range of options, including custom templates and lifecycle management similar to AD CS but hosted in the cloud. These third-party CAs allow you to:

• Create custom certificate templates.
• Automate certificate issuance, renewal, and revocation.
• Integrate with Azure Key Vault for secure storage and management of certificates.

If you require custom certificates (e.g., for IIS, NGINX) and have already deployed Active Directory Certificate Services (AD CS) on-premises, you can continue using AD CS for issuing custom certificates. You can also integrate Azure services like Azure AD and Azure Key Vault to enhance security, key management, and deployment. In this case, AD CS continues to issue and manage certificates, including custom templates for web servers. Azure Key Vault can store these certificates securely and enable seamless deployment to applications.

If you are using Azure App Services and need certificates for web applications, Azure App Service Certificates might also be useful. This service allows you to easily provision and manage SSL/TLS certificates for web applications hosted on Azure. However, this is primarily for public SSL certificates (like DigiCert and Let's Encrypt) and does not provide full PKI lifecycle management like AD CS.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin