Manage Certificates in Windows Azure

Management certificates permit client access to resources in your Windows Azure subscription. Management certificates are x.509 v3 certificates that only contain a public key, and are saved as a .cer file.

Common uses of management certificates

• The CSUpload Command-Line Tool uses management certificates for authentication when deploying VM role images. For more information one using CSUpload to deploy VM role images, see Upload a VHD to Windows Azure.
  
  
• Requests made using the Windows Azure Service Management REST API require authentication against a certificate that you provide to Windows Azure; see Authenticating Service Management Requests for details. You must upload a management certificate to Windows Azure using the Management Portal.
  
  
• Windows Azure Tools for Microsoft Visual Studio use management certificates to authenticate a user to create and manage your deployments. For more information on using the Visual Studio tools to deploy applications, see Deploy the Windows Azure Application from Visual Studio.
  
  

The same certificate can be used on more than one computer to manage a Windows Azure subscription. In order to move a management certificate from one computer to another development computer, it must be exported in the form of a PFX file and then reimported on other development computer.

Important

There is a limit of 100 management certificates per Windows Azure subscription. There is also a limit of 100 management certificates for all subscriptions under a specific service administrator’s user ID. If the user ID for the account administrator has already been used to add 100 management certificates and there is a need for more certificates, you can add a co-administrator to add the additional certificates. Before adding more than 100 certificates, see if you can reuse an existing certificate. Using co-administrators adds potentially unneeded complexity to your certificate management process. For more information on adding co-administrators, see Add and Remove Co-Administrators for Your Windows Azure Subscriptions.

Service certificates provide secure interactions for users of your web application or service. A common case is a certificate that's associated with an HTTPS endpoint, but you can use service certificates in other ways as well. Service certificates, defined in your service definition, are automatically deployed to the virtual machine that is running an instance of your role. You can upload service certificates to Management Portal either using the Management Portal or by using the Service Management API. Service certificates are associated with a specific hosted service and assigned to a deployment in the service definition file.

Service certificates can be managed separately from your services, and may be managed by different individuals. For example, a developer may upload a service package that refers to a certificate that an IT manager has previously uploaded to Windows Azure. An IT manager can manage and renew that certificate changing the configuration of the service without needing to upload a new service package. This is possible because the logical name for the certificate and its store name and location are specified in the service definition file, while the certificate thumbprint is specified in the service configuration file. To update the certificate, it's only necessary to upload a new certificate and change the thumbprint value in the service configuration file.

Warning
If the configuration is changed in this manner it will potentially be out of sync with the development platform. This means that updates could potentially be written over if the configuration on the development computer is not updated before uploading updates to the service. The recommend solution is to upgrade the service with a new configuration file. This ensures that the change is not lost.

Service certificates are x.509 v3 certificates that are uploaded to Windows Azure and stored in the hosted service in which they will be used. Service certificates are private key (.pfx) files. Service certificates are used for both SSL and remote desktop decryption which require a certificate with a private key.

There are three primary uses for service certificates:

• Encryption – RDP password encryption.
  
  
• Server – SSL provide communications security for secure web pages.
  
  
• Mutual Authentication – WCF client authentication.
  
  

The SSH keys enable you to remotely access and authenticate connections to a Linux virtual machine from a Linux or Windows client. The current version of the Windows Azure Management Portal only accepts SSH public keys that are encapsulated in an X509 certificate that contains a 2048-bit key pair. For more information on generating and using SSH keys to access a Linux virtual machine, see How to Use SSH with Linux on Windows Azure.