Create your own serverless PKI with .NET & Azure Key Vault

on YouTube ↗01h 01m

" summary

Builds a serverless CA in .NET using Azure Functions and Azure Key Vault to issue X.509 certs at scale (thousands to millions for IoT) and integrate with Device Provisioning Service and IoT Hub. Private root key stays in Key Vault/HSM; root is generated locally then imported because Key Vault marks generated certs as non‑CA. Uses MSAL/Azure AD for auth, blob storage for serial numbers, and Ori Novotny’s Key Vault RSA adapter to sign CSR digests remotely; includes a PFX reimport workaround for Windows so device private keys persist.

AI-written summary · about

" chapters (10)

1. 0:00Introduction and context
2. 3:42IoT data ingestion basics
3. 11:23Public key infrastructure explained
4. 21:56Building a serverless CA in .NET
5. 31:44Generating root certificate
6. 40:13Issuing device certificates
7. 51:07Storing certificates on devices
8. 56:24Configuring device provisioning
9. 57:51End-to-end demo
10. 59:56Key takeaways and resources

" related talks

• 56mCreate Your Own Serverless PKIEran Stiller · .NET Fest 2019
• 57mProtecting Encryption Keys with Azure Key VaultStephen Haunts · NDC Minnesota 2018
• 59mProtecting Encryption Keys with Azure Key VaultStephen Haunts · NDC Oslo 2018
• 47mSecuring Serverless Applications in AzureSjoukje Zaal · Build Stuff 2020
• 01h 03mProtecting Encryption Keys with Azure Key VaultStephen Haunts · NDC Copenhagen 2019
• 56mProtecting Encryption Keys with Azure Key VaultStephen Haunts · NDC Security Oslo 2019
• 51mRun modern PKI workflows with HCP Vault on AWSRob Barnes, David Mills · AWS re:Invent 2023
• 22mSecure your secrets with automationAndrea Giunta · SREday London 2022