# Keep inbound VPN certificate exports separate from outbound private-key material

> Map certificate direction before preparing an Azure site-to-site authentication change.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:09+00:00
- Modified: 2026-09-17T16:38:44+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Map certificate direction before preparing an Azure site-to-site authentication change.

## Potentially affected

Review this distinction when preparing certificate authentication between an eligible Azure VPN gateway and an approved on-premises VPN device. Confirm the actual gateway SKU and device compatibility before collecting certificate files or assigning access.

## DSE recommendation

DSE recommends a direction-specific certificate register: identify what authenticates Azure to the site, what authenticates the site to Azure, and where each artifact belongs.

## Article

## Source facts

Microsoft’s site-to-site certificate-authentication procedure exports the inbound certificate as a Base-64 X.509 CER file without its private key. The outbound certificate is handled through a separate Key Vault import workflow. Microsoft also states that Basic VPN gateways do not support this authentication method. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway-portal).

## Applicability

Review this distinction when preparing certificate authentication between an eligible Azure VPN gateway and an approved on-premises VPN device. Confirm the actual gateway SKU and device compatibility before collecting certificate files or assigning access.

## DSE recommendation

DSE recommends a direction-specific certificate register: identify what authenticates Azure to the site, what authenticates the site to Azure, and where each artifact belongs. Assign an owner to each export and import. Review the inbound export settings before transfer, and keep private-key material and its password out of ordinary tickets. Follow the complete current procedure for outbound storage and managed-identity permissions.

## Verification

Inspect the inbound artifact’s format, subject and fingerprint without exposing key material. Have a second operator reconcile its identity with the approved connection configuration. Test the authorized tunnel establishment and record which certificate was used. A successful file export alone should not close the authentication change.

## Official references

[Microsoft Learn: Create S2S VPN Connection Between On-premises Network and Azure Virtual Network – Certificate Authentication: Azure portal](https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway-portal).

## Primary reference

- Name: Create S2S VPN Connection Between On-premises Network and Azure Virtual Network - Certificate Authentication: Azure portal - Azure VPN Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-certificate-authentication-gateway-portal
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep inbound VPN certificate exports separate from outbound private-key material,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-051-keep-inbound-vpn-certificate-exports-separate-from-outbound-private-key-material/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.