What Is Azure Key Vault and How to Use It for Code Signing
-
Azure Key Vault is Microsoft's cloud service for storing keys, secrets, and certificates. With the right tier, it can hold your code signing key in a cloud HSM. Here's how it works and what to check before you start.
- Automatic renewals
- Less manual work
-
-
*
What Is Azure Key Vault?
Azure Key Vault is part of Microsoft Azure. It stores cryptographic keys, passwords, API keys, and certificates in one place and controls who can use them. Applications don't get a copy of a key. They send a request to Key Vault, and Key Vault performs the operation, such as creating a signature.
Key Vault comes in different tiers, and not all of them protect keys with hardware:
Tier How keys are protected Code signing Standard In software only (FIPS 140-2 Level 1) Not suitable Premium Software or HSM-protected keys. HSM keys are kept in shared, Microsoft-managed HSMs (FIPS 140-3 Level 3 for new keys). Suitable, with HSM-protected keys only Managed HSM HSM-protected keys only, in a dedicated single-tenant HSM pool (FIPS 140-3 Level 3) Suitable, at a higher cost For background on how HSMs work, see What Is a Hardware Security Module (HSM)? .
-
*
Why Use Key Vault for Code Signing?
- No physical token. The signing key lives in Azure, so there's nothing to plug in, lose, or pass between team members.
- Signing from build pipelines. Build servers and CI/CD tools such as Azure DevOps or GitHub Actions can sign releases automatically, without a person and a USB token involved.
- Access control. Permissions are managed through Microsoft Entra ID (formerly Azure Active Directory), so you decide exactly which users and services can sign.
- Audit trail. Every use of the key can be logged, which shows who signed what and when.
Key Vault isn't always the better option. If you sign a few releases a year from one computer, a USB token is simpler and has no ongoing per-operation costs.
-
*
What You Need for Code Signing
Since June 2023, a code signing key must be generated and stored in hardware certified to at least FIPS 140-2 Level 2 or equivalent. In Azure Key Vault, this means:
- Premium tier or Managed HSM. The Standard tier protects keys in software only and doesn't meet the requirement.
- An HSM-protected key of the RSA-HSM type, created inside Key Vault and marked as non-exportable.
- A key size of at least 3072 bits. See Key Size Requirements for Code Signing Certificates .
Important: The Premium tier can store both software and HSM-protected keys. When you create the key, make sure it's an HSM-protected (RSA-HSM) key. A software-protected key won't be accepted for a code signing certificate, even in a Premium vault.
-
*
How the Process Works
- Create an HSM-protected key and a certificate signing request (CSR) in your Key Vault.
- Place your code signing order with GoGetSSL and paste the CSR into the order form.
- We send the CSR to the certificate authority, which checks that the key was generated in an HSM and validates your organization.
- Once the certificate is issued, merge it with the request in Key Vault.
- Sign your files with a signing tool that supports Azure Key Vault.
For step-by-step instructions, see How to Code Sign Your Application with Azure Key Vault .
-
*
Which Certificates Work with Azure Key Vault
GoGetSSL and DigiCert code signing certificates work with any cloud HSM certified to FIPS 140 Level 2, Common Criteria EAL 4+, or equivalent, including Azure Key Vault Premium and Managed HSM. Sectigo code signing certificates support only a fixed list of devices that doesn't include Azure Key Vault.
Tip: GoGetSSL provides the certificate, not the cloud service. You'll need your own Azure subscription with a Premium vault or Managed HSM before placing the order.
-
