Create and merge a certificate signing request in Key Vault

Azure Key Vault can store digital certificates issued by any certificate authority (CA). It supports creating a certificate signing request (CSR) with a private/public key pair. Any CA (an internal enterprise CA or an external public CA) can sign the CSR. A CSR is a message sent to a CA to request a digital certificate.

For more general information about certificates, see Azure Key Vault certificates.

If you don't have an Azure subscription, create a trial subscription before you begin.

Add certificates in Key Vault issued by partnered CAs

Key Vault partners with the following certificate authorities to simplify certificate creation.

Provider	Certificate type	Configuration setup
DigiCert	Key Vault offers OV or EV SSL certificates with DigiCert	Integration guide
GlobalSign	Key Vault offers OV or EV SSL certificates with GlobalSign	Integration guide

Add certificates in Key Vault issued by non-partnered CAs

Follow these steps to add a certificate from CAs that aren't partnered with Key Vault. (For example, GoDaddy isn't a trusted Key Vault CA.)

Portal
PowerShell

Go to the key vault that you want to add the certificate to.
On the properties page, select Certificates.
Select the Generate/Import tab.
On the Create a certificate screen, choose the following values:
- Method of Certificate Creation: Generate.
- Certificate Name: A unique name for your certificate.
- Type of Certificate Authority (CA): Certificate issued by a non-integrated CA.
- Subject: "CN=www.contosoHRApp.com".
Note

If you're using a Relative Distinguished Name (RDN) that has a comma (,) in the value, wrap the value that contains the special character in double quotes.

Example entry to Subject: DC=Contoso,OU="Docs,Contoso",CN=www.contosoHRApp.com

In this example, the RDN OU contains a value with a comma in the name. The resulting output for OU is Docs, Contoso.
Select the other values as desired, and then select Create to add the certificate to the Certificates list.
In the Certificates list, select the new certificate. The current state of the certificate is disabled because it hasn't been issued by the CA yet.
On the Certificate Operation tab, select Download CSR.
Have the CA sign the CSR (.csr file).
After the request is signed, on the Certificate Operation tab, select Merge Signed Request to add the signed certificate to Key Vault.

The certificate request has now been successfully merged.

Create a certificate policy. Because the CA chosen in this scenario isn't partnered, IssuerName is set to Unknown and Key Vault doesn't enroll or renew the certificate.
```
$policy = New-AzKeyVaultCertificatePolicy -SubjectName "CN=www.contosoHRApp.com" -ValidityInMonths 1  -IssuerName Unknown
```
Note

If you're using a Relative Distinguished Name (RDN) that has a comma (,) in the value, use single quotes for the full value or value set, and wrap the value that contains the special character in double quotes.

Example entry to SubjectName: $policy = New-AzKeyVaultCertificatePolicy -SubjectName 'OU="Docs,Contoso",DC=Contoso,CN=www.contosoHRApp.com' -ValidityInMonths 1 -IssuerName Unknown. In this example, the OU value reads as Docs, Contoso. This format works for all values that contain a comma.

In this example, the RDN OU contains a value with a comma in the name. The resulting output for OU is Docs, Contoso.

Create the CSR.

$csr = Add-AzKeyVaultCertificate -VaultName "<vault-name>" -Name "<certificate-name>" -CertificatePolicy $policy
$csr.CertificateSigningRequest

Have the CA sign the CSR. The $csr.CertificateSigningRequest is the base encoded CSR for the certificate. You can dump this blob into the issuer's certificate request website. This step varies from CA to CA. Look up your CA's guidelines on how to execute this step. You can also use tools such as certreq or openssl to get the CSR signed and complete the process of generating a certificate.
Merge the signed request in Key Vault. After the CA signs the request, merge it with the private/public key pair originally created in Azure Key Vault.
```
Import-AzKeyVaultCertificate -VaultName "<vault-name>" -Name "<certificate-name>" -FilePath C:\test\OutputCertificateFile.cer
```

The certificate request has now been successfully merged.

Add more information to the CSR

If you want to add more information when creating the CSR, define it in SubjectName. You might want to add information such as:

region
City/locality
State/province
Organization
Organizational unit

Example

SubjectName="CN = learn.microsoft.com, OU = Microsoft Corporation, O = Microsoft Corporation, L = Redmond, S = WA, C = US"

Note

If you're requesting a Domain Validation (DV) certificate with additional information, the CA might reject the request if it can't validate all the information in the request. The additional information might be more appropriate if you're requesting an Organization Validation (OV) certificate.

FAQs

How do I monitor or manage my CSR?

See Monitor and manage certificate creation.
What if I see the error The public key of the end-entity certificate in the specified X.509 certificate content does not match the public part of the specified private key. Please check if certificate is valid?

This error occurs when the signed CSR you're merging wasn't produced from the same CSR you initiated. Each new CSR has its own private key, which must match when you merge the signed request.
When a CSR is merged, does it merge the entire chain?

Yes, provided you bring back a .p7b file to merge.
What if the issued certificate is in disabled status in the Azure portal?

View the Certificate Operation tab to review the error message.
What if I see the error The subject name provided is not a valid X500 name?

This error can occur when SubjectName contains special characters. See the notes in the portal and PowerShell instructions.
The CSR used to get your certificate has already been used. Please try to generate a new certificate with a new CSR.

Go to the Advanced Policy section of the certificate and check whether Reuse Key on Renewal is turned off.

Next steps

Last updated on 2026-07-17