on - edited on by
Jeff_Giroux_F5
Welcome back to our series on F5 NGINXaaS for Azure! Last time we set up basic load balancing using NGINXaaS for Azure. Today, we’re going to look at using Azure Key Vault to manage the keys for TLS offloading.
Azure Key Vault
Much like how NGINXaaS for Azure takes care of managing the underlying infrastructure to run NGINX Plus instances, Azure Key Vault manages key storage, including secure Hardware Security Modules (HSMs), to keep sensitive cryptographic material secure and away from prying eyes. NGINXaaS for Azure integrates with Azure Key Vault to manage your TLS keys in a secure manner.
Getting Started
We’ll pick up where we left off from our previous article; we’ve configured an NGINXaaS for Azure instance, and we have it load balancing to a pool of backend servers.
NGINX for Azure Diagram
Creating a Managed Identity
To use Azure Key Vault, we need to be able to authorize our NGINX instance access the appropriate key material. We do this with a Managed Identity (MI). To create the identity:
- Search for “Managed Identities” in the top search bar
- Click “Create”
- Select a resource group and region for the identity
- Give the identity a name
- Click “Review and Create”, then “Create”
Create a Managed Identity
We then need to ensure that our MI has the correct permissions to use the vault. Our vault uses Access Policies rather than RBAC, so our process is:
- Open the key vault and select “Access Policies” from the left-hand menu
- Click “Create”
- Select the “GET” Secrets permission and click “Next”
- Select the Managed Identity for our NGINX instance as the Principal
- Click through to finish creating the Access Policy
Azure Key Vault Access PolicyIf you are using RBAC, the process is similar but you need give your MI the “Key Vault Secrets User” or higher role in the vault’s IAM menu.
Configure NGINX
Now that we have our vault access set up, we can assign our Managed Identity to our NGINX instance and use a certificate from that vault in our NGINX config. Like last time, I won’t be screenshotting every click, but full documentation is available at the official NGINX docs.
- From your NGINX instance, click “Identity” from the left-hand menu
- Click “Add
- Select the Managed Identity, and click “Add”
Add User Assigned MI
Now to configure the certificate:
- Click “NGINX Certificates” from the left-hand menu
- Click “Add Certificate”
- Give the certificate a name
- Specify the path to where your NGINX config will find the certificate and key
- Select the key vault and certificate that you wish to use
- Click “Save”
Add Certificate to NGINX Instance
From here it’s just like configuring TLS offload on any NGINX instance. Listen on 443, and specify the ssl_certificate and ssl_certificate_key paths we created above.
NGINX TLS configuration
Now let’s test it out: I got the red lock here because I used a self-signed certificate, but the fingerprint matches what’s in Azure Key Vault.
TLS Browsing Result
TLS Certificate
Summary
While we could have just uploaded our certificate and key with the configuration set, that archive would then contain sensitive key material, and needs to be protected. Using NGINXaaS for Azure with Azure Key Vault provides a secure way to manage your TLS secrets. Stay tuned to learn more advanced features of NGINXaaS for Azure.
