title | description | services | author | ms.service | ms.topic | ms.date | ms.author | ms.custom |
---|---|---|---|---|---|---|---|---|
Add a custom CA certificate - Azure API Management | Microsoft Docs | Learn how to add a custom CA certificate in Azure API Management. You can also see instructions to delete a certificate. | api-management | dlepow | azure-api-management | how-to | 06/01/2021 | danlep |
[!INCLUDE api-management-availability-premium-dev-standard-basic-no-v2]
Azure API Management allows installing CA certificates on the machine inside the trusted root and intermediate certificate stores. This functionality should be used if your services require a custom CA certificate.
The article shows how to manage CA certificates of an Azure API Management service instance in the Azure portal. For example, if you use self-signed client certificates, you can upload custom trusted root certificates to API Management.
CA certificates uploaded to API Management can only be used for certificate validation by the managed API Management gateway. If you use the self-hosted gateway, learn how to create a custom CA for self-hosted gateway, later in this article.
[!INCLUDE api-management-workspace-availability]
[!INCLUDE updated-for-az]
:::image type="content" source="media/api-management-howto-ca-certificates/00.png" alt-text="CA certificates in the Azure portal":::
Follow the steps below to upload a new CA certificate. If you have not created an API Management service instance yet, see the tutorial Create an API Management service instance.
Navigate to your Azure API Management service instance in the Azure portal.
In the menu, under Security, select Certificates > CA certificates > + Add.
Browse for the certificate .cer file and decide on the certificate store. Only the public key is needed, so the password is optional.
:::image type="content" source="media/api-management-howto-ca-certificates/02.png" alt-text="Add CA certificate in the Azure portal":::
Select Save. This operation may take a few minutes.
Note
You can also upload a CA certificate using the New-AzApiManagementSystemCertificate
PowerShell command.
Select the certificate, and select Delete in the context menu (...).
If you use a self-hosted gateway, validation of server and client certificates using CA root certificates uploaded to API Management service is not supported. To establish trust, configure a specific client certificate so that it's trusted by the gateway as a custom certificate authority.
Use the Gateway Certificate Authority REST APIs to create and manage custom CAs for a self-hosted gateway. To create a custom CA:
- Add a certificate .pfx file to your API Management instance.
- Use the Gateway Certificate Authority - Create Or Update REST API to associate the certificate with the self-managed gateway.