Search code examples
linuxazuressl-certificatevirtual-machinecertificate-store

SSL Certificate is not found in /var/lib/waagent/ for Linux Azure VM

I am trying to add an SSL certificate for my website hosted in a Linux Virtual Machine. I added the certificate successfully doing this:

$certURL=(Get-AzureKeyVaultSecret -VaultName $keyVaultName -Name $key).id
$vm=Get-AzureRmVM -ResourceGroupName $resourceGroup -Name $vmName
$vaultId=(Get-AzureRmKeyVault -ResourceGroupName $resourceGroup -VaultName $keyVaultName).ResourceId
$vm = Add-AzureRmVMSecret -VM $vm -SourceVaultId $vaultId -CertificateUrl $certURL

Update-AzureRmVM -ResourceGroupName $resourceGroup -VM $vm

Then, I checked that the certificate was added successfully:

az vm secret list --name $vmName --resource-group $resourceGroup
[
  {
    "sourceVault": {
      "id": "/subscriptions/...."
    },
    "vaultCertificates": [
      {
        "certificateStore": null,
        "certificateUrl": "https://name.vault.azure.net:443/secrets/ssl/123456ABCDFG (example)"
      }
    ]
  }
]

However, when I check in /var/lib/waagent/, I can't find the certificate 123456ABCDFG. I don't know where it is?

Solution

  • I just followed the Tutorial: Secure a web server on a Linux virtual machine in Azure with SSL certificates stored in Key Vault. When you create a VM, certificates and keys are stored in the protected /var/lib/waagent/ directory.

    In fact, the SSL certificate is referenced by the version ID in certificateUrl, the 123456ABCDFG is the CURRENT VERSION of your certificate in your key vault.

    Check the Version enter image description here

    Check the certificate Thumbprint, the certificate is indeed there. enter image description here

    In addition, I validated your Powershell commands with az module, it also works on my side.

    $certURL=(Get-azKeyVaultSecret -VaultName $keyVaultName -Name $key).id
$vm=Get-azVM -ResourceGroupName $resourceGroup -Name $vmName
$vaultId=(Get-azKeyVault -ResourceGroupName $resourceGroup -VaultName $keyVaultName).ResourceId
$vm = Add-azVMSecret -VM $vm -SourceVaultId $vaultId -CertificateUrl $certURL

Update-azVM -ResourceGroupName $resourceGroup -VM $vm

    enter image description here

    Edit

    If you would like to run scripts developed for AzureRM module using Az module, use the Enable/Disable-AzureRmAlias cmdlets to add or remove aliases from AzureRM cmdlets to Az cmdlets. Refer to more details here. The AzureRm module will be retired, it's recommended to use the new Az module.

    I test your old PowerShell commands as below: enter image description here