Azure Key Vault

Use Azure Key Vault as the HSM for a DigiCert OV or EV code signing certificate from GeoCerts:

  1. Generate a CSR in Key Vault (RSA-HSM, non-exportable)
  2. Order the certificate in CertCommand with that CSR
  3. Merge the issued certificate back into the same Key Vault certificate object

1. Create or use a Key Vault

  1. In the Azure Portal, go to Key Vaults → + Create.
  2. Choose the Premium pricing tier (required for HSM-backed keys).
  3. Assign yourself Key Vault Administrator (or equivalent certificate permissions) via Access Control (IAM).

EV: Premium + RSA-HSM + Exportable: No is required for EV-compliant key storage.

2. Generate a certificate placeholder and CSR

  1. In the vault, go to Certificates → + Generate/Import → Generate.
  2. Set:
    • Method: Certificate issued by a non-integrated CA
    • Name: for example MyCodeSignCert
    • Subject: CN=Your Organization Name
    • Content Type: PKCS #12
  3. Expand Advanced Policy Configuration:
    • Key Type: RSA-HSM
    • Key Size: 3072 or 4096
    • Exportable: No
    • Enhanced Key Usage (EKU): add 1.3.6.1.5.5.7.3.3 (Code Signing)
  4. Click Create.

Download the CSR

  1. When the certificate operation is Pending, open the certificate.
  2. Certificate Operation → Download CSR.
  3. Save the .csr file for the GeoCerts order.

3. Order from GeoCerts

  1. In CertCommand, click New Certificate.
  2. Choose OV Code Signing or EV Code Signing.
  3. Choose Install on HSM (or the HSM provisioning option) and paste the CSR from Key Vault.
  4. Complete validation. Respond to DigiCert’s HSM attestation email if you receive one.

4. Download the issued certificate

  1. Open the order in CertCommand → Download Certificate Files.
  2. Prefer PKCS #7 (.p7b) so the leaf and intermediates are in one file. A concatenated PEM/CRT chain also works.

5. Merge into Key Vault

  1. Return to Key Vault → Certificates → your pending certificate.
  2. Certificate Operation → Merge Signed Request.
  3. Upload the .p7b (or full-chain PEM/CRT).
  4. Click Merge.

Do not rekey or create a new CSR unless you intend to start a new order.

Sign with AzureSignTool

After a successful merge, sign with a tool that can use Key Vault. Example using AzureSignTool:

AzureSignTool sign \
  -kvu https://<your-vault-name>.vault.azure.net/ \
  -kvc MyCodeSignCert \
  -kvi <client-id> \
  -kvs <client-secret> \
  -kvt <tenant-id> \
  -tr http://timestamp.digicert.com \
  -td sha256 \
  -fd sha256 \
  -v yourApp.exe

Use an app registration (or managed identity) with permission to use the Key Vault key/cert. Prefer managed identity or a certificate credential over a long-lived client secret in production.

See also Windows (SignTool) for timestamping notes. SignTool itself does not talk to Key Vault; use AzureSignTool or a Key Vault library.

Checklist

  • Premium Key Vault + RSA-HSM + non-exportable (required for EV)
  • Merge on the same cert object that generated the CSR
  • Full chain (P7B or concatenated PEM) for the merge
  • No rekey unless you are starting a new order

← Back to Cloud HSM