Keep inbound VPN certificate exports separate from outbound private-key material

Source facts

Microsoft’s site-to-site certificate-authentication procedure exports the inbound certificate as a Base-64 X.509 CER file without its private key. The outbound certificate is handled through a separate Key Vault import workflow. Microsoft also states that Basic VPN gateways do not support this authentication method. Microsoft Learn.

Applicability

Review this distinction when preparing certificate authentication between an eligible Azure VPN gateway and an approved on-premises VPN device. Confirm the actual gateway SKU and device compatibility before collecting certificate files or assigning access.

DSE recommendation

DSE recommends a direction-specific certificate register: identify what authenticates Azure to the site, what authenticates the site to Azure, and where each artifact belongs. Assign an owner to each export and import. Review the inbound export settings before transfer, and keep private-key material and its password out of ordinary tickets. Follow the complete current procedure for outbound storage and managed-identity permissions.

Verification

Inspect the inbound artifact’s format, subject and fingerprint without exposing key material. Have a second operator reconcile its identity with the approved connection configuration. Test the authorized tunnel establishment and record which certificate was used. A successful file export alone should not close the authentication change.

Official references

Microsoft Learn: Create S2S VPN Connection Between On-premises Network and Azure Virtual Network – Certificate Authentication: Azure portal.