Certificate Import to Key Vault and Access Request

Library: Track & Trace Documentation Library
Version: 1
Effective date: November 22, 2024

Contents

• 1 Manual: How to Import Certificate to Key Vault and Request Access
• 2 How to Request Access to Key Vault
• 3 How To Generate & Remove & Import Certificates
• 4 How to Generate the Certificate
• 5 Document Control
  • 5.1 Contact Person
  • 5.2 Revision History
• 6 Conversion and Preservation Notes

---

1 Manual: How to Import Certificate to Key Vault and Request Access

1. Go to portal.azure.com and pick your Key Vault:

   keyvault-msfwex33-02-TnT

   Image placeholder: Azure portal home page showing keyvault-msfwex33-02-TnT in the recent-resources list. The original screenshot was intentionally omitted.

2. Go to Certificates and click Generate/Import.

   Image placeholder: Azure Key Vault Certificates page with the Generate/Import action highlighted. The original screenshot was intentionally omitted.

3. Select Import as the method of certificate creation.

   Image placeholder: Azure Create a certificate form with Import selected as the method of certificate creation. The original screenshot was intentionally omitted.

4. Upload your certificate and mention the password for it.

   Image placeholder: Azure certificate-import form showing an example certificate name, uploaded .pfx file and masked password. The original screenshot was intentionally omitted.

5. Use the following rules for creating the certificate name:

   [APP]-[LOC]-[ENV]

   Element	Meaning
   APP	Code name of the application, such as GLA or TPM
   LOC	Region, if defined. For global purposes, use JTI
   ENV	Environment in which the certificate is used: DEV, QA or PRD

   Examples:

   GLA-IZM-PRD

   Certificate for the GLA application, Izmir region, for production purposes.

   TPM-JTI-QA

   Certificate for the TPM application, for testing purposes.

2 How to Request Access to Key Vault

1. Go to Requesting access to an Azure Cloud subscription or Cloud resource and choose Access to Cloud Subscription.

2. Select Reader access.

   Reference:

   RITM2344397

   Image placeholder: Access-request form showing Reader selected as the access type. The original screenshot was intentionally omitted.

3. Select the following values:

   Field	Value
   Cloud Subscription	MSFAZX33
   Cloud Resource name	keyvault-msfwex33-02-TnT

   Image placeholder: Access-request form showing the selected cloud subscription and Key Vault resource. The original screenshot was intentionally omitted.

4. A new request item will be created using the selected data.

   Example reference:

   RITM2346191

   Image placeholder: Request details for creating or modifying the Azure security group. The original screenshot, including ownership and membership details, was intentionally omitted.

5. After you receive membership in the required Active Directory group, use the following naming structure:

   [Subscription]-rgrp-[Resource]-[Role]

   Example:

   MSFAZX33-rgrp-keyvault-msfwex33-02-TnT-reader

   You may then access:

   keyvault-msfwex33-02-TnT

3 How To Generate & Remove & Import Certificates

Applications need Corporate Repository certification for the Corporate Repository connection.

Certificates are annual and must be specific to each application and environment.

Certificate-expiration notification emails are sent to people from the following distribution list:

DLGDCTnTSecuritycertificate-expiration@jti.com

Image placeholder: Example certificate-expiration notification email showing the expiration date, certificate name and Key Vault. The original screenshot was intentionally omitted.

Responsible Persons

Application or activity	Responsibility	Responsible person
GLA	Certificate request	Ugur Camtas
TPM	Certificate request	Samet Kiraz
WMS	Certificate request	Utku Kalkan
MOM	Certificate request	Utku Kalkan
Key Vault	Certificate upload	Bugra Bozkurt

Responsible persons should generate the certificate while indicating the certificate name.

The generated folder then needs to be signed by WL through a service-request ticket.

Example WL ticket:

INC4580201

WL will provide the signed form of the certificate and the secret ID by email.

After receiving these files, run the build command on them to finalize the creation of the new certificate.

More details about this process are available through the link referenced in the source document.

4 How to Generate the Certificate

The Certificate – Overview documentation on Azure may be checked for additional details.

After all stages are completed, the following files are available inside the private and public folders:

• CRT
• KEY
• PASS
• PASS2

The following files should be uploaded to EPV:

• CRT
• KEY
• PASS

The following items should be forwarded to the person responsible for installing the certificate in the application:

• PFX
• PASS2
• Secret ID, which will also be provided by WL inside the built certificate folder

The following files should be uploaded to APIM:

• PASS2
• PFX

All these stages need to be completed before the expiration date.

The old certificate must not be deleted before the new certificate has been tested and confirmed as working.

5 Document Control

5.1 Contact Person

07/25: Questions and feedback regarding this standard should be submitted to Dana Adriana Zainescu.

5.2 Revision History

Version	Effective date	Purpose of change	Author
1	November 22, 2024	First version of the document	Sean Policarpio