Secardeo certPort Deployment Guide for Web App

1.1 Purpose of this document

This guide describes the deployment of the Secardeo certPort software as an Azure App Service in Microsoft Azure. It serves as a guideline for planning, deploying, configuring, and operating certPort. This document combines the supported Azure deployment methods in a single guide. certPort can be deployed using the Azure Marketplace, by direct ARM template deployment, or with Terraform. While the individual deployment steps differ depending on the selected method, the required prerequisites and many post-deployment configuration steps are identical. Alternatively, certPort can also be installed on a Windows Server using the provided executable installer. This deployment model is not covered in this document and is described separately in the certPort Manual Deployment Guide.

1.2 Functions and architecture

certPort is a proxy for automatically enrolling certificates for servers, clients, devices, and users from public and private certification authorities. certPort supports the following protocols for certificate requests:

• ACME
• EST
• SCEP

certPort is installed as an Azure web app that is running in Azure. certPort uses an SQL database which can be hosted in Azure SQL, Azure Database for MySQL, MSSQL or MySQL. To retrieve necessary information from Entra ID, certPort communicates with your Azure tenant over the Graph API. The permissions for this are managed via an Azure app registration. An Azure Key Vault is used for storing of credentials that are required for certPort.

2.1 Backend CA

For the issuance of digital certificates, a certification authority (CA) is required. certPort supports various private or public CAs. Currently the following certification authorities are supported:

• ACME
• AWS ACM-PCA
• DigiCert CertCentral
• DogTag CA
• D-Trust
• EJBCA
• GlobalSign Atlas
• GlobalTrust SOAP
• OpenXPKI
• Secardeo certVault CA
• Sectigo Certificate Manager (SCM) REST
• SwissSign CMC
• TOPKI REST
• Windows CA HTTP

For the configuration of certPort, you need to prepare required API credentials and information about the certificate products/profiles that you want to request. These values are different depending on the chosen certification authority and are described further in the manual.

2.2 Database requirements

certPort stores relevant information about certificates, requests, and configurations in a database. A database connection is always required for certPort to function. certPort supports the following database types:

Managed:

• Azure SQL (recommended)
• Azure Database for MySQL

Self-hosted:

• Microsoft SQL Server 2016 or higher
• MySQL v9 or higher

The database requires approximately 90 KB per enrolled certificate (including expired certificates). certPort supports SQL authentication for all database types. If Azure SQL is used, Entra authentication is available and recommended. Please refer to chapter 5.3 for more information on the database configuration.

2.3 License

certPort follows a bring-your-own license (BYOL) model. Upon installation, a 90-day demo license is automatically applied for trial usage. To use certPort productively, a valid license must be provided for continued use. To obtain a serial number for the license, please contact info@secardeo.com. After receiving your serial number, follow the steps described in the certPort manual to install and activate your license.

2.4 Azure permissions

For the deployment of certPort, the following permissions are required:

• Global Administrator permissions
• Contributor permissions on the selected Azure subscription.

This is only required during the deployment and not for the certPort configuration according to the manual.

3.1 Additional preparation for Azure Marketplace only

Before starting the deployment from the Azure Marketplace, an app registration must be created manually in Microsoft Entra ID. This is required because the marketplace deployment expects the application identity and related credentials to be provided during deployment.

3.1.1 Create app registration

Create a new app registration in the Azure portal and configure it as a single-tenant application. Detailed documentation from Microsoft can be found here: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app. The core steps are outlined in the following:

1. Go to your Azure portal and search for "App registrations".

2. Click on "New registration".

3. Choose a name, e.g. "certPort".

4. Choose "Single tenant only".

5. Click "Register".

3.1.2 Create and record client secret

1. On the newly registered app registration under "Certificates & secrets" -> "Client secrets", click "New client secret".

2. Give it a name, e.g. "certPort". Create a client secret and choose an appropriate expiration (recommended: 24 months)

3. On the "Certificates & secrets" page under "Client secrets" copy the secret string from the "Value" field. Save this secret to a safe place. It won't be shown again when you leave the page.

4. Also save the "Application (client) ID" and the "Directory (tenant) ID" for later. You can find them on the "Overview" page of the app registration.

3.1.3 Configure API permissions

Next, you must configure the permissions that certPort will get in your Azure tenant. In your App registration go to "Manage" -> "API Permissions". There, you must click on "Add a permission", then "Microsoft Graph", and then on "Application permissions". There add the following permissions:

Note: The delegated permission "User.Read" is added by default and should not be removed. You will also need to configure the following Intune Permissions. To do this, click again on "Add a permission", then "Intune", and then on "Application permissions":

After you added all required permissions, you must grant them by pressing the button "Grant admin consent for <tenant>".

3.1.4 Adding groups as an optional claim

To verify the user permissions, certPort requires the configuration of claims of the app registration in Azure. For this, you must navigate to the app registration in Azure and go to "Manage" -> "Token configuration". There, you must select "Add groups claim", select "Security groups" and press "Add". If you have more than 200 Entra ID groups, it is recommended to select the option "Groups assigned to the application" and assign the group to the application in the "Users and Groups" selection from the "Enterprise applications" list (see Manage users and groups assignment to an application - Microsoft Entra ID | Microsoft Learn).

3.2 Configure role groups

3.2.1 Administrator group

To create the administrator group that is privileged to access certPort:

1. Go to your Azure portal, search for "Entra ID" and click on "Groups".

2. Click "New group".

3. Select "Group type" Security, give the group a "Group name" and optionally a "Group description".

4. Select the "Owners" and the "Members" of the group.

5. Click "Create".

6. Go to "All groups" and copy the "Object Id" of the group created. It is required during a later step.

3.2.2 SCEP dynamic password group

If certPort is used together with SCEP dynamic passwords, a dedicated security group in Microsoft Entra ID must be configured for the users who are allowed to request SCEP dynamic passwords through certPort. To create this group in Entra ID, do the following:

1. Click "New group".

2. Select "Group type" Security, give the group a "Group name" and optionally a "Group description".

3. Select the "Owners" and add the "Members" who should be allowed to use the SCEP dynamic password feature.

4. Click "Create".

5. the "Members" of the group.

6. Click "Create".

4.1 Azure ARM Template Deployment

The ARM template must be executed in a windows powershell session. Powershell version 7+ is supported.

1. Please install Azure CLI as described in Install the Azure CLI on Windows | Microsoft Learn. Ensure that the Azure CLI version is 2.80.0 or later. To verify the installed version restart powershell:

 az version 

2. Login as the global administrator in the Azure CLI session:

 az login 

3. List available subscriptions and target your desired subscripton

 az account list --output table
az account set --subscription "<subscription-name-or-id>" 

4. Verify the active subscription

 az account show 

5. Create a resource group in your preferred Azure region

 az group create -n <certport-rg-name> -l <rg-location> 

6. Invoke the ARM template (you can find a list of generated resources in Appendix B)

 az deployment group create --resource-group "<certport-rg-name>" --template-uri https://secardeo.blob.core.windows.net/certport/mainTemplate.json 

7. When prompted, provide values for the following deployment parameters:

a. "webAppName": the name of the webapp

b. "appServiceSku": the app service plan SKU. Use either "B1", "P0v3" or "P1v3". See Appendix A) for reference on the platform requirements.

c. "keyVaultName": the name of the keyvault being created

d. "certPortAdminGroup": the "Object ID" of the administrator group configured in section 3.2.1

e. "appRegistrationDisplayName": the name of the app registration being created.

f. "applicationPackageUrl": The URL of the deployed certPort application package (.zip)

g. "certPortEnableAuditLogging": Specifies whether certPort audit logging is enabled.

8. After entering the required values, your web app will be deployed (~5 min)

9. Once the deployment is complete, you can review the created resources by opening the Azure portal and selecting "Resource groups".

4.2 Azure Marketplace deployment

After locating certPort in the Azure Marketplace, select the certPort offer and click "Create".

4.2.1 Basics

The first page contains the general Azure deployment settings:

1. Select your Azure subscription.

2. Select an existing resource group or create a new one.

3. Select an Azure region.

4. Enter a name for the app service. The default hostname will be created by Azure as <webapp-name>.azurewebsites.net. The hostname can be changed later according to chapter 5.4.1.

5. Click "Next".

4.2.2 App Service Configuration

On this page, configure the App Service hosting settings:

1. Enter the name of the App Service Plan.

2. Select the pricing tier of the App Service Plan. See Appendix A) for the recommended platform requirements. This value can be modified at any time later.

3. Enter the package URL of the certPort deployment ZIP file.

4. Select "Enable audit logging" to enable certPort audit logging. This option is selected by default.

5. Click "Next".

4.2.3 Key vault & app registration

1. Choose your desired key vault SKU. Select "Standard" for a non-HSM key vault. For an HSM-backed key vault, select "Premium".

2. Choose a unique global name for your key vault. This name may not match the name of your web app.

3. Enter the Client ID of your app registration created in step 3.1.1.

4. Enter the Client Secret of your app registration in step 3.1.1.

5. Confirm the Client Secret of your app registration.

6. Enter your Tenant ID.

7. Enter the Object ID of the Enterprise Application (service principal). You can find this in the Azure portal under "Enterprise Applications", then search for the app registration created in step 3.1.1 and copy its "Object ID".

8. Click "Next".

4.2.4 Entra ID Configuration

On this page, configure the certPort authorization groups:

1. Select the certPort Administrator group's "Object Id" of the group configured in step 3.2.1.

2. Click "Next".

4.2.5 Review + create

After entering the required values, review the configuration and click "Create". This deployment will create the certPort Azure Web App and the required Azure resources such as:

• Azure Service Plan
• Web App
• Key Vault
• Virtual Network and subnets
• Log Analytics workspace
• Data Collection Endpoint and Data Collection Rule
• Required role assignments for the web app and the provided Enterprise Application

The deployment typically takes about 5 minutes.

After the deployment has been completed, follow these steps:

1. In the Outputs page, you can find the URL over which you can access certPort in the attribute "webAppUrl".

2. Open https://<FQDN>/certPort to access certPort.

3. You can continue with the post deployment steps described in chapter 5.

4.3 Terraform Deployment

The Terraform configuration must be executed in a Windows PowerShell session. Ensure that Terraform is installed and that you are authenticated to the target Azure tenant and subscription.

1. Install Terraform as described in Install | Terraform | HashiCorp Developer. To verify the installed version, restart Powershell and run:

 terraform version 

2. Login to Azure:

 az login 

3. List available subscriptions and target your desired subscription:

 az account list --output table
az account set --subscription "<subscription-name-or-id>" 

4. Verify the active subscription

 az account show 

5. Download the certPort Terraform deployment package and extract it

 Invoke-WebRequest -Uri "https://secardeo.blob.core.windows.net/certport/certPort-Terraform.zip" -OutFile "certPort-Terraform.zip"
Expand-Archive -Path ".\certPort-Terraform.zip" -DestinationPath ".\certPort-Terraform"
cd .\certPort-Terraform 

6. Review and update the Terraform variable values in terraform.tfvars or provide them as input variables. Ensure that the required values are set, including:

a. resource_group_name: the name of the resource group

b. location: the Azure region

c. web_app_name: the name of the web app

d. app_service_sku: the app service plan SKU. Use either "B1", "P0v3" or "P1v3". See Appendix A) for reference on the platform requirements.

e. key_vault_name: the name of the Key Vault being created

f. admin_group_object_id: the Object ID of the administrator group configured in section 3.2

g. application_package_url: the URL of the deployed certPort application package (.zip)

h. certport_enable_audit_logging: Specifies whether certPort audit logging is enabled.

7. Initialize the terraform working directory:

 terraform init 

8. Review the execution plan:

 terraform plan 

9. Apply the terraform configuration

 terraform apply 

10. After entering the required values and confirming the deployment, the certPort infrastructure will be deployed. The deployment typically takes about 5 minutes.

5.1 Configure Entra ID authentication (only for marketplace deployment)

To login to certPort, you must follow these steps:

1. In the Azure portal, go to "App registrations" and open the certPort app registration.

2. Go to "Manage -> Authentication".

3. Click on "Add Redirect URI"

4. Choose "Web"

5. Enter https://<FQDN>/certPort/signin-oidc ("<FQDN>" is the domain name of your app service) at "Redirect URI".

6. Enter https://<FQDN>/certPort/signout-oidc ("<FQDN>" is the domain name of your app service) at "Front-channel logout URL".

7. Click "Configure"

5.2 Grant app registration API permissions

Next grant the app registration API permissions.

1. In the Azure portal, open the configuration of your app registration and click on "Manage->API permissions".

2. Click "Grant admin consent for <your-company-name>".

3. In the Azure portal, open the certPort app service and click "Restart"

5.3 Database configuration

5.3.1 Create database server

certPort requires a database server. There are different options for deploying the database:

1. Managed (recommended): Deploy a fully managed database server in Azure (e.g. Azure SQL or Azure Database for MySQL). This is recommended for production use due to easier maintenance, backups and high availability

2. Self-hosted: You can use your own existing database server (for example, an on- premises MS SQL Server or MySQL server that you manage) If you choose the Managed option and don't have an already existing database server yet, we suggest creating one in your Azure Tenant. You can choose between Azure SQL or MySQL.

5.3.1.1 Create managed Azure SQL server

1. In the Azure portal, search for "SQL servers" in the top search bar.

2. Click "Create" and enter a globally unique server name.

3. Under "Basics -> Authentication method", choose the option that fits your setup:

a. "Use Microsoft Entra-only authentication" (see 5.3.3)

b. "Use both SQL and Microsoft Entra authentication", or

c. "Use SQL authentication"

Note: SQL authentication is often easier to configure, however Microsoft Entra authentication is recommended

4. Please decide the database administrator. Configure the "Microsoft Entra admin" and/or "Instance admin login" depending on the selection of the "Authentication method".

a. If you want to use SQL authentication, you must create a new user with a password that will be set as the administrator of the database. Please remember the credentials of the "Instance admin login" to create an additional database user for certPort. This is required in the database configuration step in the certPort manual.

b. If you choose "Microsoft Entra authentication", you must configure an Entra ID account that will be set as the administrator of the database server. If you want to configure Entra authentication as a login option, you must be able to login as the "Microsoft Entra admin" at the database server (see chapter 5.3.3).

5. In the "Networking" tab, toggle "Allow Azure services and resources to access this server" to "Yes".

6. In the "Security" tab, you don't need to configure anything

7. Configure the rest of the attributes according to your needs or leave them with the default

8. Click "Review + Create" and "Create"

9. After the database server is deployed, click on the database server.

10. Go to "Security" -> "Networking" and configure the networking. The database server must be accessible from the certPort web app.

5.3.1.2 Create managed MySQL server

1. Go to your Azure portal and search for "Azure Database for MySQL servers".

2. Click "Create" and enter a server name, e.g. "TOPKI".

3. For "Authentication method", choose at least "Use SQL authentication". certPort does not support Microsoft Entra authentication for MySQL databases.

4. Configure a "Server admin login" and password. This is the database administrator. Please remember the credentials. They are required in the database configuration step in the certPort manual.

5. In the "Networking" tab toggle "Allow Azure services and resources to access this server" to "Yes".

6. Configure the rest of the attributes according to your needs or leave the with the default.

5.3.2 Network configuration for Azure SQL server

5.3.2.1 Private endpoint

To connect certPort with the database, the database must be integrated into the virtual network using a private endpoint.

1. In the Azure portal, open your SQL server

2. Navigate to "Networking"

3. Select the "Private access" tab and click "Create a private endpoint"

4. In the "Basics" tab:

a. Select the correct subscription and the certPort resource group

b. "Name": Provide a name (e.g. pe-certPort-sql)

c. "Region": select the region of the certPort resource group

d. Click "Next: Resource"

5. In the "Resource" tab:

a. "Target sub-resource": "sqlServer"

b. Click "Next: Virtual Network"

6. In the "Virtual Network" tab:

a. "Virtual network": Select the vnet-certport virtual network created by the ARM template or Terraform deployment

b. "Subnet": select the subnet-private-endpoints subnet created by the ARM template or Terraform deployment

c. Click "Next: DNS"

7. In the "DNS" tab:

a. Integrate with private DNS zone: select "Yes"

8. Click "Next: Tags", "Next: Review + create" and "Create" to create the private endpoint

5.3.2.2 Public endpoint (only required for Entra authentication)

To enable Entra authentication, you must temporarily have network access to the SQL database from somewhere where you can run SQL commands. Under "Public access - Networking - Firewall rules" click "Add your client IP address". Press "Save". You can remove this after the deployment is finished.

5.3.3 Configure Entra authentication for Azure SQL (Recommended)

certPort can connect to Azure SQL databases using Entra Authentication via the app registration. Alternatively, you can use SQL authentication to connect to the previously configured DB server. For this, the app registration user has to be created with proper permissions on the database server. For more information, please refer to the Microsoft documentation.

1. Go to the Azure portal to "Enterprise applications" -> "All applications"

2. Select the app registration configured in chapter 3.1.1

3. Copy the "Object ID"

4. Go in the Azure portal to "Azure SQL" and select the Azure SQL database server to get the "Microsoft Entra admin" account

5. Login to the database server as the "Microsoft Entra admin". You can use "Microsoft SQL Server Management Studio"

6. Create the external user for the app registration on the database server based on the "Object ID":

 CREATE USER [<name-of-app-registration>]
FROM EXTERNAL PROVIDER
WITH OBJECT_ID = '<object-id>';
GO
ALTER ROLE dbmanager ADD MEMBER [<name-of-app-registration>];
ALTER ROLE loginmanager ADD MEMBER [<name-of-app-registration>]; 

Note: The "[" and "]" symbols are required and must not be removed.

7. You can validate that the user was successfully created with the following command:

 SELECT name, type_desc, authentication_type_desc
FROM sys.database_principals
WHERE type IN ('E', 'X')
AND name = '<name-of-app-registration>'; 

5.4 Optional configuration

5.4.1 Custom domain name

The deployed certPort web app automatically receives a default domain name. To configure a custom domain name, please refer to the Microsoft documentation: https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain Please make sure you have the necessary rights at your DNS provider for your custom domain name. After configuring a custom domain name, you must update the redirect URIs on the App Registration. You can follow the instructions at chapter 5.1 with your selected domain name.

5.4.2 Enable Application Insights logging

Application Insights logging is only available for Enterprise Edition. During deployment, certPort automatically provisions the required Azure Monitor resources for centralized logging and auditing, including the Log Analytics workspace, the operational and audit custom tables, the related data collection resources, and the audit export to immutable Blob Storage. Whether certPort writes audit events is controlled by the audit logging option selected during deployment and cannot be changed after deployment. If Application Insights should be used for additional application monitoring, it must be enabled manually in the Azure portal after the deployment has completed. You can enable it by following these steps:

1. Open the Azure portal, search for "App Services" and select your certPort Web App

2. Open "Monitoring" -> "Application Insights"

3. Select "Enable"

4. Under "Change your resource", select "Create new resource"

5. Enter a resource name for the new Application Insights resource

6. Select the Log Analytics Workspace that was created during the certPort deployment

7. Press "Apply"

5.4.3 Disable automatic software updates

Per default, certPort automatically updates itself to the newest released version. If you want to disable the automatic software update, please contact us at support@secardeo.com.

5.4.4 IoT Hub permissions

If you want to use an Azure IoT Hub in combination with certPort where IoT devices request certificates at certPort then the app registration requires the following roles in Azure. certPort can automatically create and deactivate devices in an IoT Hub or through a Device Provisioning Service. More information can be found in the certPort manual.

• Reader on the subscription or resource group (only to select the services from the list)
• Device Provisioning Service Data Contributor on the Device Provisioning Service
• IoT Hub Registry Contributor on every IoT hub that the devices use
• Contributor on the Device Provisioning Service or IoT hub (only required to set up the trust automatically)

Now, the deployment of certPort is completed and you can proceed with the certPort configuration. For this, open your web browser and enter the URL https://<FQDN>/certPort. You can find the FQDN in Azure under "App Services" -> <name-of-app-registration> -> Overview -> default domain. The configuration of certPort is described in the certPort manual. The following information must be available to configure certPort:

• The connection parameters for the backend CA (FQDN of CA server, name of the CA, and CA credentials)
• The Entra ID groups (administrator group, SCEP dynamic password group)
• For setting up the database connection:
• FQDN or IP of the SQL server
• The corresponding port of the SQL server
• Credentials for accessing the database (username and password; user must have read and write permissions)
• For e-mail notifications (Exchange Online):
• Permissions for the app registration
• E-mail address of originator and recipient (operator)
• For e-mail notifications (SMTP):
• DNS name of the mail server
• E-mail address of originator and recipient (operator)
• Optional: username and password for mail server authentication
• Depending on the SMTP server the firewalls must allow the port 25, 465 or 587.

Please check with your mail server administrator for the correct port

• Consider for each certificate status, who should receive an e-mail regarding the status change

Secardeo GmbH
Hohenadlstr. 4
D-85737 Ismaning
Germany
E-Mail: support@secardeo.com
Phone: +49 89 18 93 58 9-8

A) Platform requirements

• Azure app service plan SKU: B1 for testing purposes, P0v3 for production use with ~100 users/active certificates, P1v3 for production use with > ~1000 users/active certificates
• Azure DB: DTU-based purchasing model, Basic (Disc 2GB)

B) ARM template resources

C) Marketplace template resources

D) Terraform resources