Register the certificate chain (BYOC)
Step 4 of 5 in Connect Azure KMS with BYOK and BYOC.
Register the chain with kind: key_certificate_chain, source: stored_public_material and
linkedKeyAlias set to the key alias from the previous step. Supply the leaf followed by any
intermediates, each DER encoded and base64 encoded. A certificate object that Azure already holds can
be registered by reference instead.
- Overview
- Request
- Response
Register the key certificate chain
Endpoint: POST /api/kms/v1/certificates/register
Captured response: 201 Created
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
The capture registers a stored chain against the tenant's default provider. Stored public material
does not depend on where the key lives, so the request is the same with an Azure providerId. The
response reports controlMode: externally_managed and fingerprints of the certificate and its public
key, which is how EDK proves the chain belongs to the linked key.
Read everything back before selecting it for an issuer. The reference shows what was registered, and the chain read shows what a relying party will receive. The reference list confirms the tenant index holds exactly this chain.
- Overview
- Request
- Response
Read one certificate reference
Endpoint: GET /api/kms/v1/certificate-references/00000000-0000-4000-8000-000000000000
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
- Overview
- Request
- Response
Read the registered chain
Endpoint: GET /api/kms/v1/certificate-chains/customer-tenant-signing-chain
Captured response: 200 OK
This captured endpoint is shown from the E2E run; it is not mapped to one of the generated EDK REST API reference pages.
Connect an environment to rewrite this call to real service bases and run it.
Do not derive a chain from a single leaf or a key alias from a certificate name. When the chain does not match the key, x5c-signed credentials fail verification even though signing itself succeeds.
Next
Continue with step 5, Remove references safely.