Skip to content

feat: NGINXaaS - Certificate Fetch via Private Endpoint support #1137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

feat: NGINXaaS - Certificate Fetch via Private Endpoint support #1137

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion content/includes/nginxaas-azure/ssl-tls-prerequisites.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,16 @@ NGINXaaS natively integrates with [Azure Key Vault (AKV)](https://azure.microsof

- If using Access Policies for AKV, ensure that your MI has *GET secrets* or higher permissions.

- Access to AKV through a public or private endpoint. If public access to AKV needs to be restricted, you can do one of the following:
- [Configure Network Security Perimeter]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}})
- [Integrate with a private endpoint]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#integrate-with-private-endpoint" >}})

- In addition to the MI permissions, if using the Azure portal to manage certificates, ensure that you have read access to list certificates inside the Key Vault:

- If using Azure RBAC for AKV, ensure that you have [Key Vault Reader](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-reader) or higher permissions.

- If using Access Policies for AKV, ensure that you have *LIST certificates* or higher permissions.

- If public access is disabled on your key vault, [configure Network Security Perimeter]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) and add an inbound access rule to allow your client IP address.
- If public access is disabled on your key vault, add an inbound access rule to allow your client IP address.

- If you're unfamiliar with Azure Key Vault, check out the [Azure Key Vault concepts](https://docs.microsoft.com/en-us/azure/key-vault/general/basic-concepts) documentation from Microsoft.
4 changes: 4 additions & 0 deletions content/nginxaas-azure/changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,10 @@ To see a list of currently active issues, visit the [Known issues]({{< ref "/ngi

To review older entries, visit the [Changelog archive]({{< ref "/nginxaas-azure/changelog-archive" >}}) section.

## TODO, 2025
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will you resolve this issue before marking this PR as "Ready to Review?"

- {{% icon-feature %}} **Support for downloading AKV certificates via Private Endpoints**

NGINXaaS now supports downloading certificate from Azure Key Vault via Private Endpoints. This will allow users to increase network security by disabling public access on their Key Vault. For more information, please visit [Integrate with Private Endpoint]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#integrate-with-private-endpoint" >}})

## August 18, 2025

Expand Down
105 changes: 88 additions & 17 deletions content/nginxaas-azure/getting-started/ssl-tls-certificates/overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ The following section describes common errors you might encounter while adding S

- **User assigned managed identity**

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `MI_NAME`: the name of the managed identity
- `MI_RESOURCE_GROUP`: the name of the resource group the managed identity is in
```shell
Expand All @@ -106,7 +106,7 @@ The following section describes common errors you might encounter while adding S

- **System assigned managed identity**

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `DEP_NAME`: the name of the NGINXaaS deployment
- `DEP_RESOURCE_GROUP`: the name of the resource group the NGINXaaS deployment is in
```shell
Expand All @@ -116,7 +116,7 @@ The following section describes common errors you might encounter while adding S
```
1. Get the resource ID of the key vault.

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `KV_NAME`: the name of the key vault
- `KV_RESOURCE_GROUP`: the name of the resource group the key vault is in
```shell
Expand Down Expand Up @@ -145,7 +145,7 @@ The following section describes common errors you might encounter while adding S

- **User assigned managed identity**

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `MI_NAME`: the name of the managed identity
- `MI_RESOURCE_GROUP`: the name of the resource group the managed identity is in
```shell
Expand All @@ -156,7 +156,7 @@ The following section describes common errors you might encounter while adding S

- **System assigned managed identity**

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `DEP_NAME`: the name of the NGINXaaS deployment
- `DEP_RESOURCE_GROUP`: the name of the resource group the NGINXaaS deployment is in
```shell
Expand All @@ -167,7 +167,7 @@ The following section describes common errors you might encounter while adding S

1. Create the access policy.

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `KV_NAME`: the name of the key vault
- `KV_RESOURCE_GROUP`: the name of the resource group the key vault is in
```shell
Expand All @@ -178,26 +178,26 @@ The following section describes common errors you might encounter while adding S
```
</details>

#### Error code: `ForbiddenByFirewall`
#### Error code: `ForbiddenByFirewall` or `ForbiddenByConnection`

**Description:** The key vault's firewall is enabled and NGINXaaS is not authorized to fetch certificates.

**Resolution:** [Configure Network Security Perimeter]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) to allow the subscription of the NGINXaaS deployment to access the key vault.

**Resolution:**
1. [Configure Network Security Perimeter]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}}) to allow the subscription of the NGINXaaS deployment to access the key vault.
<details>
<summary>Create a network security perimeter - Azure CLI</summary>

1. Create a network security perimeter.

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `NSP_NAME`: the name of the network security perimeter
- `NSP_RESOURCE_GROUP`: the name of the resource group the network security perimeter will be in
```shell
az network perimeter create --name $NSP_NAME --resource-group $NSP_RESOURCE_GROUP
```
1. Create a profile for the network security perimeter.

Please ensure the following environment variable is set before copying the below Azure CLI command.
Set the following environment variable is set before copying the below Azure CLI command.
- `PROFILE_NAME`: the name of the network security perimeter profile
```shell
az network perimeter profile create --name $PROFILE_NAME \
Expand All @@ -206,7 +206,7 @@ The following section describes common errors you might encounter while adding S
```
1. Get the resource ID of the key vault.

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `KV_NAME`: the name of the key vault
- `KV_RESOURCE_GROUP`: the name of the resource group the key vault is in
```shell
Expand All @@ -230,7 +230,7 @@ The following section describes common errors you might encounter while adding S
```
1. Add an inbound access rule to allow the NGINXaaS deployment's subscription.

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `RULE_NAME`: the name of the access rule
- `DEP_SUBSCRIPTION_ID`: the subscription ID of the NGINXaaS deployment
```shell
Expand All @@ -242,6 +242,77 @@ The following section describes common errors you might encounter while adding S
```
</details>

2. Integrate with a Private Endpoint to allow NGINXaaS to fetch certificates via Azure Private Link.
<details>
<summary>Create a Private Link - Azure CLI</summary>

1. Get the resource ID of the key vault.

Set the following environment variables before copying the below Azure CLI command.
- `KV_NAME`: the name of the key vault
- `KV_RESOURCE_GROUP`: the name of tshe resource group the key vault is in
```shell
key_vault_id=$(az keyvault show --name $KV_NAME \
--resource-group $KV_RESOURCE_GROUP \
--query id --output tsv)
```

2. Create a private endpoint.

Set the following environment variables before copying the below Azure CLI command.
- `PE_NAME`: the name of the private endpoint
- `PE_RESOURCE_GROUP`: the name of the resource group the private endpoint will be in
- `VNET_NAME`: the name of the virtual network that is delegated to NGINXaaS
- `VNET_RESOURCE_GROUP`: the name of the resource group the virtual network is in
- `SUBNET_NAME`: the name of the subnet for private endpoints
- `PE_CONNECTION_NAME`: the name of the private endpoint connection
- `LOCATION`: the location of the virtual network
```shell
az network private-endpoint create --name $PE_NAME \
--resource-group $PE_RESOURCE_GROUP \
--vnet-name $VNET_NAME \
--subnet $SUBNET_NAME \
--private-connection-resource-id $key_vault_id \
--group-id vault \
--connection-name $PE_CONNECTION_NAME \
--location $LOCATION
```

1. Create a private DNS zone and link VNet.

Set the following environment variables before copying the below Azure CLI command.
- `ZONE_RESOURCE_GROUP`: the name of the resource group for the DNS zone
- `ZONE_NAME`: the name of the DNS zone
- `DNS_LINK_NAME`: the name of the DNS zone link
```shell
vnet_id=$(az network vnet show --name $VNET_NAME \
--resource-group $VNET_RESOURCE_GROUP \
--query id --output tsv)
```
```shell
az network private-dns zone create --resource-group $ZONE_RESOURCE_GROUP \
--name $ZONE_NAME
az network private-dns link vnet create --resource-group $ZONE_RESOURCE_GROUP \
--zone-name $ZONE_NAME \
--name $DNS_LINK_NAME \
--virtual-network $vnet_id \
--registration-enabled false
```

1. Add DNS zone group to the private endpoint.

Set the following environment variables before copying the below Azure CLI command.
- `DNS_ZONE_GROUP_NAME`: the name of the resource group for the DNS zone
```shell
az network private-endpoint dns-zone-group create \
--resource-group $PE_RESOURCE_GROUP \
--endpoint-name $PE_NAME \
--name $DNS_ZONE_GROUP_NAME \
--private-dns-zone $ZONE_NAME \
--zone-name $ZONE_NAME
```
</details>

#### Error code: `AnotherOperationInProgress`

**Description:** Another operation on this, or a dependent resource, is in progress.
Expand Down Expand Up @@ -273,7 +344,7 @@ The following section describes common errors you might encounter while adding S

- **User assigned managed identity**

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `MI_NAME`: the name of the managed identity
- `MI_RESOURCE_GROUP`: the name of the resource group the managed identity is in
```shell
Expand All @@ -284,7 +355,7 @@ The following section describes common errors you might encounter while adding S

- **System assigned managed identity**

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `DEP_NAME`: the name of the NGINXaaS deployment
- `DEP_RESOURCE_GROUP`: the name of the resource group the NGINXaaS deployment is in
```shell
Expand All @@ -295,7 +366,7 @@ The following section describes common errors you might encounter while adding S

1. Create the access policy.

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `KV_NAME`: the name of the key vault
- `KV_RESOURCE_GROUP`: the name of the resource group the key vault is in
```shell
Expand Down Expand Up @@ -323,7 +394,7 @@ The following section describes common errors you might encounter while adding S

1. Get the resource ID of the certificate.

Please ensure the following environment variables are set before copying the below Azure CLI command.
Set the following environment variables before copying the below Azure CLI command.
- `CERT_NAME`: the name of the certificate
- `KV_NAME`: the name of the key vault
```shell
Expand Down
8 changes: 8 additions & 0 deletions content/nginxaas-azure/known-issues.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,14 @@ url: /nginxaas/azure/known-issues/

List of known issues in the latest release of F5 NGINXaaS for Azure (NGINXaaS).

### {{% icon-bug %}} Certificate failures when managed identities with access is added after deployment creation

This issue occurs when public access is disabled on Azure Key Vault (AKV) and the managed identity that has access to AKV is added to the NGINXaaS deployment after creation.

Updating managed identities on an NGINXaaS deployment after creation may result in the managed identity not being correctly delegated to the dataplane, which can cause certificate fetch failures.

**Workaround**: To avoid this issue, when you create an NGINXaaS deployment, make sure that the managed identity with access to AKV is assigned during initial creation. If managed identities need to be updated after creation, enable public access to AKV or [configure Network Security Perimeter]({{< ref "/nginxaas-azure/quickstart/security-controls/certificates.md#configure-network-security-perimeter-nsp" >}})

### {{% icon-bug %}} Custom and precompiled security policies cannot both be referenced in an NGINX configuration

When using NGINX App Protect WAF, you can only reference default or custom security policies in your NGINX configuration, not both.
Expand Down
Loading