{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/", "slug": "dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material", "url": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/" }, "title": "Keep inbound VPN certificate exports separate from outbound private-key material", "summary": "Map certificate direction before preparing an Azure site-to-site authentication change.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:09+00:00", "modified_at": "2026-09-17T16:38:44+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 213, "potentially_affected": "Review this distinction when preparing certificate authentication between an eligible Azure VPN gateway and an approved on-premises VPN device. Confirm the actual gateway SKU and device compatibility before collecting certificate files or assigning access.", "dse_recommendation": "DSE recommends a direction-specific certificate register: identify what authenticates Azure to the site, what authenticates the site to Azure, and where each artifact belongs.", "primary_source": { "name": "Create S2S VPN Connection Between On-premises Network and Azure Virtual Network - Certificate Authentication: Azure portal - Azure VPN Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s site-to-site certificate-authentication procedure exports the inbound certificate as a Base-64 X.509 CER file without its private key. The outbound certificate is handled through a separate Key Vault import workflow. Microsoft also states that Basic VPN gateways do not support this authentication method. Microsoft Learn.

\n

Applicability

\n

Review this distinction when preparing certificate authentication between an eligible Azure VPN gateway and an approved on-premises VPN device. Confirm the actual gateway SKU and device compatibility before collecting certificate files or assigning access.

\n

DSE recommendation

\n

DSE recommends a direction-specific certificate register: identify what authenticates Azure to the site, what authenticates the site to Azure, and where each artifact belongs. Assign an owner to each export and import. Review the inbound export settings before transfer, and keep private-key material and its password out of ordinary tickets. Follow the complete current procedure for outbound storage and managed-identity permissions.

\n

Verification

\n

Inspect the inbound artifact’s format, subject and fingerprint without exposing key material. Have a second operator reconcile its identity with the approved connection configuration. Test the authorized tunnel establishment and record which certificate was used. A successful file export alone should not close the authentication change.

\n

Official references

\n

Microsoft Learn: Create S2S VPN Connection Between On-premises Network and Azure Virtual Network – Certificate Authentication: Azure portal.

", "content_text": "Source facts\nMicrosoft’s site-to-site certificate-authentication procedure exports the inbound certificate as a Base-64 X.509 CER file without its private key. The outbound certificate is handled through a separate Key Vault import workflow. Microsoft also states that Basic VPN gateways do not support this authentication method. Microsoft Learn.\nApplicability\nReview this distinction when preparing certificate authentication between an eligible Azure VPN gateway and an approved on-premises VPN device. Confirm the actual gateway SKU and device compatibility before collecting certificate files or assigning access.\nDSE recommendation\nDSE recommends a direction-specific certificate register: identify what authenticates Azure to the site, what authenticates the site to Azure, and where each artifact belongs. Assign an owner to each export and import. Review the inbound export settings before transfer, and keep private-key material and its password out of ordinary tickets. Follow the complete current procedure for outbound storage and managed-identity permissions.\nVerification\nInspect the inbound artifact’s format, subject and fingerprint without exposing key material. Have a second operator reconcile its identity with the approved connection configuration. Test the authorized tunnel establishment and record which certificate was used. A successful file export alone should not close the authentication change.\nOfficial references\nMicrosoft Learn: Create S2S VPN Connection Between On-premises Network and Azure Virtual Network – Certificate Authentication: Azure portal.", "content_markdown": "## Source facts\n\nMicrosoft’s site-to-site certificate-authentication procedure exports the inbound certificate as a Base-64 X.509 CER file without its private key. The outbound certificate is handled through a separate Key Vault import workflow. Microsoft also states that Basic VPN gateways do not support this authentication method. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway-portal).\n\n## Applicability\n\nReview this distinction when preparing certificate authentication between an eligible Azure VPN gateway and an approved on-premises VPN device. Confirm the actual gateway SKU and device compatibility before collecting certificate files or assigning access.\n\n## DSE recommendation\n\nDSE recommends a direction-specific certificate register: identify what authenticates Azure to the site, what authenticates the site to Azure, and where each artifact belongs. Assign an owner to each export and import. Review the inbound export settings before transfer, and keep private-key material and its password out of ordinary tickets. Follow the complete current procedure for outbound storage and managed-identity permissions.\n\n## Verification\n\nInspect the inbound artifact’s format, subject and fingerprint without exposing key material. Have a second operator reconcile its identity with the approved connection configuration. Test the authorized tunnel establishment and record which certificate was used. A successful file export alone should not close the authentication change.\n\n## Official references\n\n[Microsoft Learn: Create S2S VPN Connection Between On-premises Network and Azure Virtual Network – Certificate Authentication: Azure portal](https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway-portal)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/", "url": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep inbound VPN certificate exports separate from outbound private-key material", "item": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/", "url": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/", "headline": "Keep inbound VPN certificate exports separate from outbound private-key material", "description": "Map certificate direction before preparing an Azure site-to-site authentication change.", "abstract": "Map certificate direction before preparing an Azure site-to-site authentication change.", "articleBody": "Source facts\nMicrosoft’s site-to-site certificate-authentication procedure exports the inbound certificate as a Base-64 X.509 CER file without its private key. The outbound certificate is handled through a separate Key Vault import workflow. Microsoft also states that Basic VPN gateways do not support this authentication method. Microsoft Learn.\nApplicability\nReview this distinction when preparing certificate authentication between an eligible Azure VPN gateway and an approved on-premises VPN device. Confirm the actual gateway SKU and device compatibility before collecting certificate files or assigning access.\nDSE recommendation\nDSE recommends a direction-specific certificate register: identify what authenticates Azure to the site, what authenticates the site to Azure, and where each artifact belongs. Assign an owner to each export and import. Review the inbound export settings before transfer, and keep private-key material and its password out of ordinary tickets. Follow the complete current procedure for outbound storage and managed-identity permissions.\nVerification\nInspect the inbound artifact’s format, subject and fingerprint without exposing key material. Have a second operator reconcile its identity with the approved connection configuration. Test the authorized tunnel establishment and record which certificate was used. A successful file export alone should not close the authentication change.\nOfficial references\nMicrosoft Learn: Create S2S VPN Connection Between On-premises Network and Azure Virtual Network – Certificate Authentication: Azure portal.", "datePublished": "2026-09-17T16:34:09+00:00", "dateModified": "2026-09-17T16:38:44+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep inbound VPN certificate exports separate from outbound private-key material" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 213, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create S2S VPN Connection Between On-premises Network and Azure Virtual Network - Certificate Authentication: Azure portal - Azure VPN Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway-portal" } } ] } }