Code Signing certificate setup in Azure Key vault

Jul 29, 2025

Code Signing certificate setup in Azure Key vault

Prerequisites

• New GlobalSign Code Signing for HSM certificate order.

• Microsoft Azure account and subscription.

Guidelines

Step 1: Create an Azure Key Vault

1. Log in to the Azure portal, then click Key Vaults.
   
   

2. In the Key Vaults home page, click Create.
   
   

3. In the Basics tab, enter the name of your key vault in the Name field and choose your Subscription preferences, Resource group (new or existing), Region, Pricing tier, Recovery options. Then, click “Next” to continue.

4. Choose the settings in the Access configuration, Networking, and Tags tabs according to your use case. 

5. Once completed, go to the Review + Create tab to review the details you have entered. Then, click Create. 

6. Once your vault is created, you will be taken to the Overview home page. To proceed, click Go to resource.​​​​​ 
   
   

Step 2: Generate CSR

1. Go to your Key Vault and select Certificates, then click Generate/Import. It will take you to the Create a Certificate page.
   
   

2. Choose Generate as the Method of Certificate Creation, then enter an easy-to-memorize name in the Certificate Name field.

3. In the Type of Certificate Authority (CA) drop down menu, select Certificate issued by an non-integrated CA.

4. Set the Subject field with the common name of the certificate you are requesting (Format: CN=Common Name). 

5. Fill out the rest of the fields:
   
   • DNS Names – where you can add additional Subject Alternative Names (SANs)
   • Validity Period – select how long the certificate is valid for in month designation.
   • Content Type: 
          • PKCS#12 – Private public key pair
          • PEM – Public key
   • Lifetime Action Type – set certificate renewals or renewal reminders

6. Advanced Policy Configuration by default is set to Not configured. Click Not Configured if you wish to add additional EKUs and set advanced key features. It will open the Advanced Policy Configuration menu.
   
   • Reuse Key on Renewal? No
   • Exportable Private Key? No
   • Key Type: RSA-HSM
   • Key Size: 4096
   • Enable Certificate Transparency: Yes
   
   Then, click OK.
   
   

7. Click Create, then a pop-up message in the right corner will confirm that the certificate is being created.
   Note: You can also click on the blue information bar to monitor the generation process. 

8. Once the Status shows Completed, click on Certificate Operation and later Download CSR file to get a copy of your CSR.

9. Save the .csr file to your local machine.

Step 3: Submit CSR File and Download/Import Certificate

1. Go to your email and open the link in the Certificate Download Ready email sent to you after completing your order. 

2. Enter the Temporary Pickup Password that was set at the time of ordering and click Next to continue. 
   
   

3. Enter your CSR on the Enter CSR Required box. Then, tick I Agree to the subscriber Agreement and click Next to proceed. 
   
   

4. Download your Digital Certificate and Intermediate Certificates.
   
   

5. Go back to Azure Key Vault and click on Merge Signed Request to import the downloaded Digital Certificate.