Welcome back! In our previous lesson, we got hands-on with Azure Key Vault by creating a vault and managing its most common object type: secrets. We established Key Vault as the secure, centralized repository for sensitive application data like connection strings and API keys.
This lesson broadens our scope to the other two fundamental object types managed by Key Vault: cryptographic keys and certificates. While secrets are about storing and retrieving data, keys and certificates are about performing cryptographic operations and establishing trust. Understanding their distinct purposes is crucial for designing secure Azure solutions and is a key topic for the AZ-204 exam. By the end of this lesson, you will be able to explain the specific use cases for both cryptographic keys and certificates in Azure Key Vault.
1. Secrets, Keys, and Certificates: What's the Difference?
Before diving into use cases, it's essential to understand the fundamental differences between the three object types that Key Vault manages. In the last lesson, we saw that a secret is essentially a blob of data you can store and retrieve. Keys and certificates behave very differently.
To build a solid mental model of these differences, let's watch a segment from John Savill, an expert who excels at clarifying complex cloud concepts.
Azure Key Vault Deep Dive (AZ-500)
In his "Azure Key Vault Deep Dive" video, John Savill provides an excellent conceptual breakdown of secrets, keys, and certificates.
Watch this part of the video, focusing on how he defines the operations for each object type: Secrets: Notice his description of a secret as arbitrary data that you can both write and read. Keys: This is the most important distinction. Pay close attention to the fact that you cannot read the private key back out. Instead, you send data to the key to perform cryptographic operations like decrypting or signing. Certificates: Understand that a certificate is a higher-level object, essentially wrapping a key with identity information and lifecycle management features.
To summarize the crucial distinctions:
| Object Type | Primary Function | Can you retrieve the raw object? |
|---|---|---|
| Secret | Store and retrieve sensitive data (e.g., passwords, connection strings). | Yes. Your application retrieves the secret's value to use it. |
| Key | Perform cryptographic operations (encrypt, decrypt, sign, verify). | No. The private key material never leaves the Key Vault boundary. |
| Certificate | Establish identity and secure communication channels (TLS/SSL). | Yes. You can retrieve the public certificate and, if needed, the private key for installation on a server. |
This "never-leave-the-boundary" principle for cryptographic keys is the cornerstone of Key Vault's security model for high-assurance operations.
2. Use Cases for Cryptographic Keys
Now that we know what keys are, let's explore why we use them. The primary purpose of keys in Key Vault is to enable data encryption and digital signing scenarios where you need to maintain control over the encryption key.
This video gives a practical overview of common scenarios.
Azure Key Vault Security Guide | Managed Identity for Web API Secrets (Hands-On Demo!)
This clip from Learn Smart Coding explains the primary uses for cryptographic keys in Key Vault.
Watch this segment to understand the main applications for keys: When to use keys: The video covers encrypting data, signing tokens, and securing certificates. The banking app example is a good illustration of encrypting data at rest.
The most prominent use cases you'll encounter are:
-
Server-Side Encryption with Customer-Managed Keys (CMK): Many Azure services like Azure Storage, Azure SQL Database, and Azure Disk Encryption encrypt your data by default using a Microsoft-managed key. For greater control and to meet compliance requirements, these services allow you to use a key that you control in your own Key Vault. This is known as the CMK pattern. The service sends data to your Key Vault to be encrypted/decrypted by your key, but the service never has direct access to the key itself.
-
Digital Signing: Keys can be used to sign data, such as a JSON Web Token (JWT). An authentication service could use a key in Key Vault to sign a JWT. A receiving application can then verify the signature using the corresponding public key, trusting that the token was issued by the legitimate service and hasn't been tampered with.
Software vs. Hardware-Protected Keys (HSM)
When you create a key, you have a critical choice to make regarding its protection level. This choice is tied to the Key Vault's pricing tier.
Azure Key Vault Deep Dive (AZ-500)
Let's return to John Savill's video for a clear explanation of the difference between the Standard and Premium tiers and how it relates to key protection.
Watch this segment carefully, as it's a frequent topic in exam questions: Standard vs. Premium: Understand that the key difference is the availability of HSM-protected keys. Software vs. Hardware: Note that secrets and certificates are always software-protected. Only keys can be protected by a Hardware Security Module (HSM) in the Premium tier. An HSM is a physical device that provides a highly secure, tamper-resistant environment for key storage and operations. Managed HSM: Briefly listen to the description of Managed HSM. This is a dedicated, single-tenant HSM service for organizations with extreme security or regulatory requirements (e.g., FIPS 140-2 Level 3).
In short:
- Standard Tier: Supports software-protected keys. Keys are processed in software but are still encrypted at rest.
- Premium Tier: Supports both software-protected keys and HSM-protected keys. HSM-protected keys are processed inside a FIPS 140-2 Level 2 validated hardware boundary.
For your work as a developer, the interaction is the same, but choosing the Premium tier for HSM-backed keys is a decision driven by security and compliance requirements.
3. Use Cases for Certificates
Certificates are a familiar concept in web development for enabling HTTPS. Azure Key Vault elevates certificate management from a manual, error-prone task to an automated, centralized process.
Azure Key Vault Security Guide | Managed Identity for Web API Secrets (Hands-On Demo!)
The "Learn Smart Coding" video also provides a concise explanation of certificate use cases.
Watch this final clip to see how certificates are used: Certificate uses: The primary use case discussed is enabling SSL/TLS for a web application to secure traffic (HTTPS).
The main scenarios for using certificates managed by Key Vault include:
-
TLS/SSL for Web Services: You can store your TLS/SSL certificates in Key Vault and configure Azure services like App Service and Application Gateway to use them directly. This is extremely powerful because Key Vault can also manage the automated renewal of these certificates, reducing the risk of service outages due to expired certificates.
-
Client Authentication: Certificates can be used as a credential for authenticating clients in service-to-service communication, providing a more secure alternative to shared secrets or passwords.
A key feature to remember is that when you create a certificate in Key Vault, the service automatically creates a corresponding key and secret under the hood to store the private key material and public certificate information. This simplifies management by treating the certificate as a single, high-level object.
Conclusion
In this lesson, we've distinguished the roles of secrets, keys, and certificates within Azure Key Vault. While secrets are for storing data, keys and certificates are tools for performing high-security cryptographic functions and managing trust.
Here are the key takeaways:
- Secrets are for storing and retrieving sensitive data blobs like connection strings.
- Cryptographic Keys are used for operations like encryption and signing. Their defining feature is that the private key material never leaves the Key Vault boundary.
- Certificates are used to establish identity and secure communication channels (TLS/SSL). Key Vault can automate their lifecycle, including renewal.
- The Premium tier of Key Vault allows you to use HSM-protected keys, which offer a higher level of security and compliance by processing keys within a dedicated hardware module.
You now have a complete picture of the objects managed by Key Vault. In our next lesson, we will put this knowledge into practice from a developer's perspective. We'll write C# code to connect a .NET application to Key Vault and programmatically retrieve the secrets we need to run our application securely.