APIM DigiCert Certificate Management

Library: Track & Trace Documentation Library
Document: APIM DigiCert Certificate Management
Version: 1
Effective date: November 22, 2024

Contents

• 1 Overview
  • 1.1 Certificate-expiration notifications
• 2 Steps to Renew the Certificate
  • 2.1 Raise the certificate request
  • 2.2 Generate the CSR file
  • 2.3 Issue or renew the certificate
  • 2.4 Download and import the certificate
  • 2.5 Export the certificate
  • 2.6 Import the certificate into Azure Key Vault
  • 2.7 Configure the APIM custom domain
  • 2.8 Provide the certificate to SAP PO
• 3 Document Control
  • 3.1 Contact Person
  • 3.2 Revision History
• 4 Conversion and Preservation Notes

---

1 Overview

Azure API Management uses DigiCert certificates for the Track and Trace domain:

tat.jti.com

1.1 Certificate-expiration notifications

DigiCert sends certificate-expiration notification emails:

• 30 days before expiration
• 14 days before expiration
• Seven days before expiration

The notification uses the following general format:

From: DigiCert <admin@digicert.com>
Subject: Your DigiCert TLS order expires in x days (Order #)

The notification is distributed to the relevant internal IT and certificate-expiration distribution lists and the DigiCert partner notification address.

Example notification heading:

YOUR ORDER IS ABOUT TO EXPIRE

The notification advises the recipient to sign in to the DigiCert CertCentral account and renew the order. It may contain:

• Certificate name
• Additional URLs or Subject Alternative Names
• Certificate-expiration date
• Order-expiration date
• Order number
• Maximum certificate-validity information

Image placeholder: Example DigiCert email notifying recipients that a Transport Layer Security certificate order will expire in 30 days. The original screenshot is not embedded in this Markdown file.

2 Steps to Renew the Certificate

2.1 Raise the certificate request

Raise a certificate request through the IT Service Portal form:

Certificate Request (commercial) | Requested Item

2.2 Generate the CSR file

After the request is approved, the requestor receives a task to generate a Certificate Signing Request file.

Follow this knowledge-base article when generating the file:

KB19517

Upload the generated .CSR file to the corresponding IT Service Portal task.

2.3 Issue or renew the certificate

After closing the Certificate Signing Request task, a new Issue Certificate task is opened.

The task provides instructions for one of the following situations:

• New certificate: Use when the previous certificate has already expired
• Renewal: Use as the default option when renewing before expiration

The IT Service Portal task includes:

• Custom DigiCert guest links
• Relevant knowledge-base articles
• Instructions for issuing or renewing the certificate

2.4 Download and import the certificate

After generating the certificate on the DigiCert website, follow the corresponding knowledge-base instructions to upload it to Azure Key Vault.

2.4.1 Download the certificate

Download the certificate from DigiCert in the following format:

.p7B

2.4.2 Open Windows Certificate Manager

Open the following Windows application:

Manage User Certificates

The application may also be opened as:

certmgr

Navigate to:

Certificates - Current User
└── Personal
    └── Certificates

Image placeholder: Windows Certificate Manager showing Certificates - Current User > Personal > Certificates and the All Tasks > Import option. The original screenshot is not embedded in this Markdown file.

2.4.3 Import the certificate

1. Expand Certificates - Current User > Personal > Certificates
2. Right-click Certificates
3. Select All Tasks > Import
4. Complete the Certificate Import Wizard

Use the appropriate instructions for the downloaded file type:

• If you have a .p7b file, select it and proceed. This file already contains the certificate chain
• If you have a .pem file, ensure that you also have the corresponding private-key file, which is usually generated when the Certificate Signing Request is created. The private key is required to export the certificate as a .pfx file

In the Certificate Import Wizard:

1. Select the downloaded .p7B file
2. Use the default option to place all certificates in the private store
3. Click Next
4. Click Finish

The new certificate appears in Certificate Manager and can then be exported.

2.5 Export the certificate

In Windows Certificate Manager:

1. Select the imported certificate
2. Right-click the certificate
3. Select All Tasks > Export

Image placeholder: Windows Certificate Manager showing the imported tat.jti.com certificate and the All Tasks > Export option. The original screenshot is not embedded in this Markdown file.

Complete the Certificate Export Wizard using the following settings:

1. Select Yes, export the private key

   If this option is unavailable, the private key is not associated with the certificate. The private key is required to create a .pfx file.

2. Select the following export format:

   Personal Information Exchange - PKCS #12 (.PFX)

3. Optionally, select:

   Include all certificates in the certification path if possible

   Use this option when the full certificate chain should be included.

4. Set a password to protect the .pfx file

   The same password is required when importing the file into Azure or another service.

5. Choose the following encryption algorithm:

   SHA-256

6. Choose the location and filename for the .pfx file

7. Complete the wizard

2.6 Import the certificate into Azure Key Vault

Open the relevant Azure Key Vault instance.

In Azure Key Vault:

1. Expand Objects
2. Select Certificates
3. Click Generate/Import
4. Select Import as the method of certificate creation
5. Enter a certificate name
6. Upload the .pfx file created in the previous step
7. Enter the same password used when exporting the .pfx file
8. Click Create

The source provides the following example values:

Field	Example value
Method of Certificate Creation	Import
Certificate Name	tat-jti-com-2024
Upload Certificate File	tat_jti_com.pfx
Password	The password assigned during export

Image placeholder: Azure Key Vault Create a certificate page showing the import method, certificate name, .pfx upload field and password field. The original screenshot is not embedded in this Markdown file.

2.7 Configure the APIM custom domain

Open the relevant Azure API Management instance.

1. Expand Deployment + infrastructure

2. Select Custom domains

3. Select the existing domain:

   tat.jti.com

   Alternatively, add it as a new domain if it does not already exist.

4. Configure the gateway domain to use the certificate stored in Azure Key Vault

The source shows the following example configuration:

Field	Example value
Type	Gateway
Hostname	tat.jti.com
Certificate source	Key Vault
Client identity	System assigned identity
Certificate	The newly imported Key Vault certificate

The source also displays the following domain options:

• Negotiated client certificate
• Default SSL binding

Image placeholder: Azure API Management gateway custom-domain configuration for tat.jti.com, using an Azure Key Vault certificate and a system-assigned identity. The original screenshot is not embedded in this Markdown file.

2.7.1 Select the certificate from Azure Key Vault

In the certificate-selection dialog:

1. Select the required subscription
2. Select the Track and Trace Key Vault
3. Select the newly imported certificate
4. Click Select
5. Click Update on the custom-domain configuration

The source provides the following certificate example:

tat-jti-com-2024

Image placeholder: Azure dialog for selecting the newly imported certificate from Azure Key Vault. The original screenshot is not embedded in this Markdown file.

Changes may require between 30 minutes and one hour to take effect.

2.7.2 Validate the certificate chain

After the update takes effect, validate the certificate and its chain.

The source example shows this hierarchy:

DigiCert Global Root G2
└── GeoTrust TLS RSA CA G1
    └── tat.jti.com

Image placeholder: Certificate viewer showing the certificate hierarchy for tat.jti.com. The original screenshot is not embedded in this Markdown file.

2.8 Provide the certificate to SAP PO

Provide the generated .pfx file to the team responsible for SAP Process Orchestration.

3 Document Control

3.1 Contact Person

As of July 2025, questions and feedback regarding this standard should be submitted to the contact person identified in the source document.

3.2 Revision History

Version	Effective date	Purpose of change	Author
1	November 22, 2024	First version of the document	Author identified in the source document