Local Rulestack

1. Select Rulestacks and select a previously created rulestack to apply the certificate.
2. Select Encrypted Threat ProtectionEgress Decryption.
3. Select a certificate.

   • Select an Untrust Certificate.
   • Select a Trust Certificate.

   Add a Certificate to Cloud NGFW for Azure if you have not done so already.

   The certificate and private key are stored in the Azure Key Vault, and the workload uses this information to decrypt the traffic.

   The certificate must be a CA certificate. Set the CA value in the Basic Constraints to TRUE. The following is an example private CA certificate.

   Certificate:
       Data:
           Version: 3 (0x2)
           Serial Number: 4121 (0x1019)
       Signature Algorithm: sha256WithRSAEncryption
           Issuer: C=US, ST=Washington, L=Seattle, O=Example Company Root CA, OU=Corp, CN=www.example.com/emailAddress=corp@www.example.com
           Validity
               Not Before: Feb 26 20:27:56 2018 GMT
               Not After : Feb 24 20:27:56 2028 GMT
           Subject: C=US, ST=WA, L=Seattle, O=Examples Company Subordinate CA, OU=Corporate Office, CN=www.example.com
           Subject Public Key Info:
               Public Key Algorithm: rsaEncryption
                   Public-Key: (2048 bit)
                   Modulus:
                       00:c0: ... a3:4a:51
                   Exponent: 65537 (0x10001)
           X509v3 extensions:
               X509v3 Subject Key Identifier:
                   F8:84:EE:37:21:F2:5E:0B:6C:40:C2:9D:C6:FE:7E:49:53:67:34:D9
               X509v3 Authority Key Identifier:
                   keyid:0D:CE:76:F2:E3:3B:93:2D:36:05:41:41:16:36:C8:82:BC:CB:F8:A0
   
               X509v3 Basic Constraints: critical
                   CA:TRUE
               X509v3 Key Usage: critical
                   Digital Signature, CRL Sign
       Signature Algorithm: sha256WithRSAEncryption
            6:bb:94: ... 80:d8

   If you're using an End-Entity certificate for decrypting traffic, only the End Entity Cert with public and private key is stored in the Azure Key Vault.

   PKCS8 is the supported certificate format.

   Trust certificates can't be self-signed, but the untrust certificate can be self-signed or CA-signed.
4. Navigate to the previously created Rulestack and go to the Managed Identity page.
5. From the Enable MI dropdown menu, select the managed identity that was associated with the key vault.
6. Click Save.