How-To: Automatically Rotate Entra ID (AAD) Application Certificates Using EZCA

Achieve cryptographic agility by automating your Azure AD application certificate rotation for free with EZCA’s automatic AAD application certificate rotation service.

Introduction - Why You Should Automatically Rotate Your Application Certificates

Did you know 80% of organizations have reported certificate related outage in the last two years? The reason is that computers are outnumbering humans at a ratio where manually managing certificates is impossible. One of the certificates that are easy to miss are certificate used for service to service authentication in Azure. While EZCA enables automatic Azure Key Vault certificate rotation, Azure does not currently support subject based certificate authentication, meaning that each new certificate must be registered in Azure AD before being used by an application. To solve this issue, we created a feature that automatically rotates your certificates when they are renewed. Giving you a fully automated credential rotation experience.

How to Configure Automatic Certificate Rotation for Entra ID Applications - Video Tutorial

Follow along with our video tutorial to see how to configure automatic certificate rotation for your Entra ID applications:

How To Configure Automatic Certificate Rotation for Entra ID Applications - Step-by-Step Guide

Follow these steps to enable automatic certificate rotation for your Entra ID application.

Step 1 - How to Give Your Application Permission to Rotate Its Own Credentials

To enable Entra ID automatic certificate rotation, we must give your application permission to rotate and manage its own credentials.

How to Get Your Application’s Object ID

Let’s begin by getting your application’s object ID, which is required to give it permission to manage its own credentials. Follow these steps:

  1. First go to the Azure portal

  2. Navigate to Entra ID > App registrations and select your application.

    Azure Active Directory App Registrations page listing all applications with their IDs and certificate status

  3. Copy your application’s object ID.

    Azure AD app registration overview page with Object ID field highlighted for copying

How to Update Your Application’s Permissions

Use the following script to give your application permission to manage its own credentials:

$YourApplicationsObjectId = "<Your Application's object ID>"
$YourEnterpriseApplicationsObjectId = "<Your Application's object ID (from enterprise app)>"
#set graph permissions 
$adgraph = Get-AzureADServicePrincipal -Filter "AppId eq '00000002-0000-0000-c000-000000000000'"
Write-Host "-ResourceId $($adgraph.ObjectId)"

# Manage apps that this app creates or owns (Role: Application.ReadWrite.OwnedBy)
$rdscope = "824c81eb-e3f8-4ee6-8f6d-de7f50d565b7"
Connect-AzureAD
New-AzureADServiceAppRoleAssignment -Id $rdscope -PrincipalId $YourEnterpriseApplicationsObjectId -ObjectId $YourEnterpriseApplicationsObjectId -ResourceId $adgraph.ObjectId
#Add Application as owner of itself
Add-AzureADApplicationOwner -ObjectId $YourApplicationsObjectId -RefObjectId $YourEnterpriseApplicationsObjectId

Step 2 - How to Grant EZCA Access to Sign Certificate Requests on Behalf of Your Application

For EZCA to be able to rotate your certificates, it requires a set of permissions on your Azure Key Vault to manage certificates and sign requests. Follow one of the following options to give EZCA the necessary permissions:

How to Grant Key Vault Reader Access to EZCA

Begin by granting EZCA Reader access to your Key Vault.

  1. Login to the Azure portal.

  2. Navigate to the Key Vault you want your application certificates to be stored in.

  3. Click on the Access control (IAM) menu option

    Azure Key Vault overview page with Access control IAM menu item in left navigation

  4. Click on + Add

    Azure Key Vault Access control IAM page with Add button highlighted to add role assignment

  5. Select the Add Role Assignment Option

  6. Select the Reader role

    Azure Add Role Assignment page showing Reader role selected in the role list

  7. Click on Members

    Azure Add Role Assignment Members tab with Select members highlighted for user principal search

  8. Click on + Select members

    Azure Add Role Assignment Members tab showing Select members panel with no members selected

  9. Search for “keytos” and select the Keytos application

    Azure Select members panel showing Keytos application highlighted in search results

  10. Click the Select button

    Azure Add Role Assignment Members tab with Keytos application selected and Select button highlighted

  11. Click the Review + assign button

    Azure Add Role Assignment review showing Reader role assigned to Keytos application with Review and assign button

  12. Click the Review + assign button

    Azure Add Role Assignment final review confirmation showing Reader role scope and Keytos member

How to Grant Certificate Management Access to EZCA

In addition to Reader access, you need to also grant EZCA permissions to manage certificates in your Key Vault. You can either use RBAC or Access Policies to do this. We recommend using RBAC as it is the more modern and flexible approach, but we support both methods to give you the flexibility to choose the one that works best for your organization.

  1. Login to the Azure portal.

  2. Navigate to the Key Vault you want EZCA to manage.

  3. Click on the Access control (IAM) menu option

    Azure Key Vault overview page with Access control IAM menu item in left navigation

  4. Click on + Add

    Azure Key Vault Access control IAM page with Add button highlighted to add role assignment

  5. Select the Key Vault Certificates Officer Role

    Give azure key vault certificates officer permission

  6. Click on Members

    Azure Add Role Assignment Members tab with Select members highlighted for user principal search

  7. Click on Select Members

    Azure Add Role Assignment Members tab showing Select members panel with no members selected

  8. Search for “keytos” and select the Keytos application

    Azure Select members panel showing Keytos application highlighted in search results

  9. Click the Select button

    Azure Add Role Assignment Members tab with Keytos application selected and Select button highlighted

  10. Click the Review + assign button

    Azure Add role assignment Members tab showing Keytos app with Key Vault Certificates Officer role assigned

  11. Click the Review + assign button

    Azure Add role assignment Review page showing Keytos app Key Vault Certificates Officer assignment with Review and assign button

  12. Repeat the same steps to also assign the Key Vault Crypto Officer role to allow EZCA to sign certificate requests on behalf of your application.

  1. Login to https://portal.azure.com

  2. Navigate to the Key Vault you want EZCA to manage.

  3. Click on the Access policies menu option

    Azure Key Vault Access policies page with Add Access Policy button highlighted

  4. Click on + Add Access Policy

    Azure Key Vault Access policies page showing current access policies list with Add Access Policy button

  5. Under Certificate permissions select: Get, Update, and Create.

    Azure Add Access Policy page showing Get, Update, and Create certificate permissions selected

  6. Under Key permissions select: Sign.

  7. Under Select principal, click on the None selected link to choose the application you want to give these permissions to.

    Azure Add Access Policy page with None selected highlighted next to Select Principal field

  8. Search for “keytos” and select the Keytos application

    Azure Key Vault Principal search panel showing Keytos application highlighted in search results

  9. Click the Select button

    Azure Add Access Policy with Keytos application selected as principal and Select button highlighted

  10. Click the Add button

    Azure Add Access Policy completed form with Add button to save the policy

  11. Click the Save button

    Azure Key Vault Access policies page with Save button highlighted to apply new EZCA access policy

Step 3 - How to Create the Entra ID Application Certificate

Once you have given your application permission to manage its own credentials and given EZCA access to manage certificates in your Key Vault, you can create your first certificate.

How to Issue Your First Certificate for Your Application

The first certificate must be created manually by you in the EZCA portal to link the certificate to your application. After the first certificate is created, EZCA will automatically rotate the certificate for you when it is close to expiring without any manual intervention required on your part. Follow these steps to create the first certificate:

  1. In your EZCA portal navigate to the My Certificates page and click on the + Create Certificate button.

  2. Enter a Subject Name for your certificate, such as the name of your application.

  3. Enter a Subject Alternative Name for your certificate, such as the name of your application.

  4. Within the Application ID field, enter your Entra ID application ID to link the certificate to your application for automatic rotation.

    EZCA Cloud PKI certificate request form with Azure Application ID field highlighted and Key Vault auto-renew enabled

  5. Drop down the Certificate Location field and select Azure Key Vault.

  6. Select your Azure Subscription and Azure Key Vault from the dropdowns to select the Key Vault you previously granted EZCA access to.

  7. Select Auto renew certificate to enable automatic certificate rotation for this certificate. This will allow EZCA to automatically rotate the certificate when it is close to expiring without any manual intervention required on your part.

  8. Click the Request Certificate button to create the certificate in your Key Vault and link it to your Entra ID application.

How to Add the Certificate to Your Application

For the first certificate, you will need to manually add it to your application in Azure. This is a security requirement to ensure that EZCA only has the specific permissions you grant it. Once the first certificate is added, EZCA will automatically add the new certificates to your application when it rotates them in the future.

  1. Navigate to the Azure portal.
  2. Go to your Azure Key Vault which contains the certificate you just created.
  3. From the left-hand menu, navigate to Certificates and select the certificate and version you just created for your application.
  4. Click on the Download in CER format button to download the certificate to your local machine.
  5. Go to Entra ID > App registrations and select your application.
  6. From the left-hand menu, navigate to Certificates & secrets.
  7. Under the Certificates tab, click on the + Upload certificate button.
  8. Upload the certificate you just downloaded from your Key Vault and click Add to add the certificate to your application.

Step 4 - How to Validate Automatic Certificate Rotation is Working

We recommend manually renewing the certificate in the portal the first time to ensure your permissions are set up correctly and the certificate rotation process is working as expected. To manually renew the certificate:

  1. In the EZCA portal navigate to the My Certificates page

  2. Click on the Renew button next to your certificate. This will trigger the certificate rotation process immediately.

    EZCA Cloud PKI My Certificates page with Renew button highlighted to manually trigger certificate rotation

  3. The certificate will be renewed in your Key Vault and the new certificate will be added to your Entra ID application. You will get a success message in the EZCA portal once the rotation process is complete.