Knowledge Base

Knowledge Base Certificate Signing Request (CSR)

Generate a CSR and Install a Certificate in Microsoft Azure Key Vault

Updated on October 12, 2026

How to generate a CSR and install a certificate in Microsoft Azure Key Vault

Summary

Steps to generate a CSR in Microsoft Azure Key Vault, order the certificate from Sectigo, and install the issued certificate in the same key vault.

Overview

By following this article, you will generate a Certificate Signing Request (CSR) in Microsoft Azure Key Vault, use it to order a Sectigo certificate, and install the issued certificate in your key vault so that it is ready to use. The private key is created and stays in Azure Key Vault; you install the certificate by merging the signed certificate with the pending request, a step that Azure calls Merge Signed Request. The article covers the prerequisites, how to generate the Certificate Signing Request (CSR), how to download it, how to order the certificate from Sectigo, how to merge the issued certificate, and how to verify the installation.

Before you begin

Confirm the following before you start:

Key vault: You have already created a key vault in your Microsoft Azure account.
Permissions: You can sign in to the Azure portal and create and manage certificates in that key vault.
Sectigo account: You can place a new Sectigo certificate order or reprocess an existing order.
Domain names: You know the main domain name and any additional domain names that the certificate must cover.

Generate the CSR in Azure Key Vault

A Certificate Signing Request (CSR) is a block of encoded text that contains your public key and certificate details. Sectigo uses it to issue your certificate.

Sign in to the Azure portal and select the key vault where you want to install the certificate.

Figure 1: Select the target key vault in the Azure portal.
In the left-hand menu of the key vault, select Certificates.

Figure 2: Select Certificates from the Key Vault Settings menu.
Click Generate/Import to open the Create a certificate form.

Figure 3: Select Generate/Import to create a certificate.
Complete the form fields as shown in the following table.

Field	What to enter or select
Method of Certificate Creation	Select Generate.
Certificate Name	Enter a unique name for the certificate.
Type of Certificate Authority (CA)	Select Certificate issued by a non-integrated CA.
Subject	Enter the X.500 Distinguished Name for the certificate. For an SSL/TLS certificate, enter the Common Name (CN) of the main domain, for example `CN=example.com`.
DNS Names	Add any additional Domain Name System (DNS) names that the SSL/TLS certificate must cover, for example `secure.example.com`.
Validity Period	Leave the default of 12 months. The validity of the issued certificate is based on your Sectigo order, not on the Certificate Signing Request (CSR).
Content Type	Select PEM (Privacy-Enhanced Mail format).
Lifetime Action Type	Optionally, configure Azure to send email alerts at a percentage of the certificate lifetime or a number of days before expiry.

Figure 4: Enter the required details in the Create a certificate form.

Optionally, click Advanced Policy Configuration to set the key type, key size, key reuse on renewal, and private key exportability. Click OK when you finish.

Figure 5: Configure the certificate’s advanced policy settings..
Click Create to generate the key pair and the Certificate Signing Request (CSR).

Figure 6: Select Create to generate the key pair and CSR.

Expected result: The certificate appears in the In progress, failed or cancelled list of the Certificates page.

Figure 7: Select the pending certificate from the certificate list.

Advanced policy options

Use these options only if your organization requires them:

Hardware Security Module (HSM)-protected key: Set Exportable Private Key to No and select RSA-HSM (Rivest–Shamir–Adleman) or EC-HSM (Elliptic Curve).
Other settings: For Sectigo certificates, you can leave Extended Key Usages (EKUs), X.509 Key Usage Flags, and Enable Certificate Transparency at their default values, and leave Certificate Type blank.

Download the CSR

On the key vault Certificates page, click the certificate name in the In progress, failed or cancelled list.
Click Certificate Operation.

Figure 8: Select Certificate Operation for the pending certificate.
Click Download CSR and save the Certificate Signing Request (CSR) file.

Figure 9: Select Download CSR to save the certificate signing request.
Open the file in a plain text editor so that you can copy its contents.

Expected result: You have a Certificate Signing Request (CSR) file that begins with -----BEGIN CERTIFICATE REQUEST----- and ends with -----END CERTIFICATE REQUEST-----.

Figure 10: Open the downloaded CSR in a text editor.

Order the certificate from Sectigo

Place a new Sectigo certificate order.
When the order asks for a Certificate Signing Request (CSR), paste the full contents of the file that you downloaded from Azure Key Vault, including the BEGIN and END lines.

Figure 11: Submit the Azure-generated CSR when ordering the certificate.
Complete the validation required for your certificate type.
After Sectigo issues the certificate, download the certificate file and save it to a location that you can access from the Azure portal. [Confirm which Sectigo certificate file format to use for the Azure merge.]

Expected result: You have the issued Sectigo certificate file for the domain names in your request.

Merge the issued certificate in Azure Key Vault

In the Azure portal, return to your key vault and select Certificates.

Figure 12: Select the certificate in the Key Vault certificate list.
Click the name of the certificate that you created in Azure Key Vault.
Click Certificate Operation.

Figure 13: Select Certificate Operation for the certificate.
Click Merge Signed Request, then select the certificate file that you downloaded from Sectigo.

Figure 14: Select Merge Signed Request to upload the issued certificate.

Expected result: Azure shows a notification that the signed request for the certificate has been successfully merged, and the certificate operation status changes to Completed.

Figure 15: Confirm that the signed certificate request was successfully merged.

Verify the installation

On the key vault Certificates page, confirm that the certificate appears in the Completed list with the status Enabled and an expiration date that matches your Sectigo order. The certificate is now installed in Azure Key Vault and ready to use.