Cloud PKI Integrations: Complete Guide

# Request a public certificate
aws acm request-certificate \
  --domain-name example.com \
  --subject-alternative-names www.example.com \
  --validation-method DNS \
  --region us-east-1

# List certificates
aws acm list-certificates --region us-east-1

# Describe certificate (get validation records)
aws acm describe-certificate \
  --certificate-arn arn:aws:acm:us-east-1:123456789:certificate/abc-123

# Create a Key Vault
az keyvault create --name mykeyvault \
  --resource-group mygroup --location eastus

# Import certificate
az keyvault certificate import \
  --vault-name mykeyvault \
  --name mycert \
  --file cert.pfx \
  --password "pfx-password"

# Create self-signed certificate
az keyvault certificate create \
  --vault-name mykeyvault \
  --name myselfsigned \
  --policy @policy.json

# Create a managed certificate
gcloud compute ssl-certificates create my-cert \
  --domains=example.com,www.example.com \
  --global

# List certificates
gcloud compute ssl-certificates list

# Create certificate map for advanced routing
gcloud certificate-manager maps create my-cert-map

# Attach to load balancer
gcloud compute target-https-proxies update my-proxy \
  --ssl-certificates=my-cert

# Enable PKI secrets engine
vault secrets enable pki

# Set max TTL
vault secrets tune -max-lease-ttl=87600h pki

# Generate root CA
vault write pki/root/generate/internal \
  common_name="My Root CA" \
  ttl=87600h

# Create a role for issuing certs
vault write pki/roles/web-server \
  allowed_domains="example.com" \
  allow_subdomains=true \
  max_ttl="72h"

# Issue a certificate
vault write pki/issue/web-server \
  common_name="api.example.com" \
  ttl="24h"

# Install cert-manager via Helm
helm repo add jetstack https://charts.jetstack.io
helm repo update

helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set installCRDs=true

# ClusterIssuer for Let's Encrypt
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
    - http01:
        ingress:
          class: nginx

# Request a certificate
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com-tls
  namespace: default
spec:
  secretName: example-com-tls-secret
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - example.com
  - www.example.com