您现在访问的是微软AZURE全球版技术文档网站,若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站,请访问 https://docs.azure.cn.

教程:在 Azure 中使用 Key Vault 中存储的 SSL 证书保护 Linux 虚拟机上的 Web 服务器Tutorial: Secure a web server on a Linux virtual machine in Azure with SSL certificates stored in Key Vault

若要保护 Web 服务器,可以使用安全套接字层 (SSL) 证书来加密 Web 流量。To secure web servers, a Secure Sockets Layer (SSL) certificate can be used to encrypt web traffic. 这些 SSL 证书可存储在 Azure Key Vault 中,并可安全部署到 Azure 中的 Linux 虚拟机 (VM)。These SSL certificates can be stored in Azure Key Vault, and allow secure deployments of certificates to Linux virtual machines (VMs) in Azure. 本教程介绍如何执行下列操作:In this tutorial you learn how to:

  • 创建 Azure Key VaultCreate an Azure Key Vault
  • 生成证书或将其上传到 Key VaultGenerate or upload a certificate to the Key Vault
  • 创建 VM 并安装 NGINX Web 服务器Create a VM and install the NGINX web server
  • 将证书注入 VM 并使用 SSL 绑定配置 NGINXInject the certificate into the VM and configure NGINX with an SSL binding

打开 Azure Cloud ShellOpen Azure Cloud Shell

Azure Cloud Shell 是免费的交互式 shell,可以使用它运行本文中的操作步骤。Azure Cloud Shell is a free, interactive shell that you can use to run the steps in this article. Cloud Shell 中预安装并配置了常用的 Azure 工具以供你的帐户使用。Common Azure tools are preinstalled and configured in Cloud Shell for you to use with your account. 需选择“复制”按钮即可复制代码,将其粘贴到 Cloud Shell 中,然后按回车来运行它。Just select the Copy button to copy the code, paste it in Cloud Shell, and then press Enter to run it. 可通过多种方式打开 Cloud Shell:There are a few ways to open Cloud Shell:

选择代码块右上角的“试用”。Select Try It in the upper-right corner of a code block. 本文中的 Cloud Shell
在浏览器中打开 Cloud Shell。Open Cloud Shell in your browser. https://shell.azure.com/bash
选择 Azure 门户右上角菜单上的“Cloud Shell”按钮。Select the Cloud Shell button on the menu in the upper-right corner of the Azure portal. 门户中的 Cloud Shell

如果选择在本地安装并使用 CLI,本教程要求运行 Azure CLI 2.0.30 或更高版本。If you choose to install and use the CLI locally, this tutorial requires that you are running the Azure CLI version 2.0.30 or later. 运行 az --version 即可查找版本。Run az --version to find the version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI.

概述Overview

Azure Key Vault 保护加密密钥和机密,例如证书或密码。Azure Key Vault safeguards cryptographic keys and secrets, such as certificates or passwords. Key Vault 有助于简化证书管理过程,让我们持续掌控用于访问这些证书的密钥。Key Vault helps streamline the certificate management process and enables you to maintain control of keys that access those certificates. 可以在 Key Vault 中创建自签名证书,或者上传已拥有的现有受信任证书。You can create a self-signed certificate inside Key Vault, or upload an existing, trusted certificate that you already own.

无需使用包含植入证书的自定义 VM 映像,而可将证书直接注入正在运行的 VM。Rather than using a custom VM image that includes certificates baked-in, you inject certificates into a running VM. 此过程可确保在部署过程中,在 Web 服务器上安装最新的证书。This process ensures that the most up-to-date certificates are installed on a web server during deployment. 如果续订或替换了证书,也不需要创建新的自定义 VM 映像。If you renew or replace a certificate, you don't also have to create a new custom VM image. 创建附加的 VM 时,会自动注入最新证书。The latest certificates are automatically injected as you create additional VMs. 在整个过程中,证书永远不会离开 Azure 平台,也不会在脚本、命令行历史记录或模板中公开。During the whole process, the certificates never leave the Azure platform or are exposed in a script, command-line history, or template.

创建 Azure Key VaultCreate an Azure Key Vault

创建 Key Vault 和证书之前,需使用 az group create 创建资源组。Before you can create a Key Vault and certificates, create a resource group with az group create. 以下示例在 eastus 位置创建名为 myResourceGroupSecureWeb 的资源组:The following example creates a resource group named myResourceGroupSecureWeb in the eastus location:

az group create --name myResourceGroupSecureWeb --location eastus

接下来,使用 az keyvault create 创建 Key Vault,并在部署 VM 时启用该 Key Vault。Next, create a Key Vault with az keyvault create and enable it for use when you deploy a VM. 每个 Key Vault 均需具备唯一名称且全部小写。Each Key Vault requires a unique name, and should be all lowercase. 将下例中的 替换为自己唯一的 Key Vault 名称:Replace in the following example with your own unique Key Vault name:

keyvault_name=<mykeyvault>
az keyvault create \
    --resource-group myResourceGroupSecureWeb \
    --name $keyvault_name \
    --enabled-for-deployment

生成证书并存储在 Key Vault 中Generate a certificate and store in Key Vault

为供生产使用,应通过 az keyvault certificate import 导入由受信任的提供程序签名的有效证书。For production use, you should import a valid certificate signed by trusted provider with az keyvault certificate import. 在本教程中,以下示例显示了如何使用 az keyvault certificate create 生成使用默认证书策略的自签名证书:For this tutorial, the following example shows how you can generate a self-signed certificate with az keyvault certificate create that uses the default certificate policy:

az keyvault certificate create \
    --vault-name $keyvault_name \
    --name mycert \
    --policy "$(az keyvault certificate get-default-policy)"

准备用于 VM 的证书Prepare a certificate for use with a VM

若要在 VM 创建过程中使用该证书,请使用 az keyvault secret list-versions 获取证书的 ID。To use the certificate during the VM create process, obtain the ID of your certificate with az keyvault secret list-versions. 使用 az vm secret format 转换该证书。Convert the certificate with az vm secret format. 以下示例将这些命令的输出分配给变量,以便在后续步骤中使用:The following example assigns the output of these commands to variables for ease of use in the next steps:

secret=$(az keyvault secret list-versions \
          --vault-name $keyvault_name \
          --name mycert \
          --query "[?attributes.enabled].id" --output tsv)
vm_secret=$(az vm secret format --secrets "$secret")

创建 cloud-init 配置以保护 NGINXCreate a cloud-init config to secure NGINX

Cloud-init 是一种广泛使用的方法,用于在首次启动 Linux VM 时对其进行自定义。Cloud-init is a widely used approach to customize a Linux VM as it boots for the first time. 可使用 cloud-init 安装程序包和写入文件,或者配置用户和安全。You can use cloud-init to install packages and write files, or to configure users and security. 在初始启动期间运行 cloud-init 时,无需额外的步骤且无需代理来应用配置。As cloud-init runs during the initial boot process, there are no additional steps or required agents to apply your configuration.

创建 VM 时,证书和密钥都将存储在受保护的 /var/lib/waagent/ 目录中。When you create a VM, certificates and keys are stored in the protected /var/lib/waagent/ directory. 若要自动将证书添加到 VM 并配置 Web 服务器,请使用 cloud-init。To automate adding the certificate to the VM and configuring the web server, use cloud-init. 本示例会安装并配置 NGINX Web 服务器。In this example, you install and configure the NGINX web server. 可以使用相同的过程来安装和配置 Apache。You can use the same process to install and configure Apache.

创建名为 cloud-init-web-server.txt 的文件并粘贴以下配置:Create a file named cloud-init-web-server.txt and paste the following configuration:

#cloud-config
package_upgrade: true
packages:
  - nginx
write_files:
  - owner: www-data:www-data
  - path: /etc/nginx/sites-available/default
    content: |
      server {
        listen 443 ssl;
        ssl_certificate /etc/nginx/ssl/mycert.cert;
        ssl_certificate_key /etc/nginx/ssl/mycert.prv;
      }
runcmd:
  - secretsname=$(find /var/lib/waagent/ -name "*.prv" | cut -c -57)
  - mkdir /etc/nginx/ssl
  - cp $secretsname.crt /etc/nginx/ssl/mycert.cert
  - cp $secretsname.prv /etc/nginx/ssl/mycert.prv
  - service nginx restart

创建安全 VMCreate a secure VM

现使用 az vm create 创建 VM。Now create a VM with az vm create. 使用 --secrets 参数插入 Key Vault 中的证书数据。The certificate data is injected from Key Vault with the --secrets parameter. 使用 --custom-data 参数传入 cloud-init 配置:You pass in the cloud-init config with the --custom-data parameter:

az vm create \
    --resource-group myResourceGroupSecureWeb \
    --name myVM \
    --image UbuntuLTS \
    --admin-username azureuser \
    --generate-ssh-keys \
    --custom-data cloud-init-web-server.txt \
    --secrets "$vm_secret"

创建 VM、安装程序包和启动应用需耗时几分钟。It takes a few minutes for the VM to be created, the packages to install, and the app to start. 创建 VM 后,请记下 Azure CLI 显示的 publicIpAddressWhen the VM has been created, take note of the publicIpAddress displayed by the Azure CLI. 此地址用于在 Web 浏览器中访问站点。This address is used to access your site in a web browser.

若要使 VM 能使用安全的 Web 流量,请通过 az vm open-port 从 Internet 中打开端口 443:To allow secure web traffic to reach your VM, open port 443 from the Internet with az vm open-port:

az vm open-port \
    --resource-group myResourceGroupSecureWeb \
    --name myVM \
    --port 443

测试 Web 应用是否安全Test the secure web app

现在可以打开 Web 浏览器,并在地址栏中输入“https://”。Now you can open a web browser and enter https:// in the address bar. 在 VM 创建过程中提供自己的公共 IP 地址。Provide your own public IP address from the VM create process. 若使用自签名的证书,请接受安全警告:Accept the security warning if you used a self-signed certificate:

接受 Web 浏览器安全警告

随即显示受保护的 NGINX 站点,如下例所示:Your secured NGINX site is then displayed as in the following example:

查看运行中的安全 NGINX 站点

后续步骤Next steps

本教程已介绍如何使用 Azure Key Vault 中存储的 SSL 证书保护 NGINX Web 服务器。In this tutorial, you secured an NGINX web server with an SSL certificate stored in Azure Key Vault. 你已了解如何:You learned how to:

  • 创建 Azure Key VaultCreate an Azure Key Vault
  • 生成证书或将其上传到 Key VaultGenerate or upload a certificate to the Key Vault
  • 创建 VM 并安装 NGINX Web 服务器Create a VM and install the NGINX web server
  • 将证书注入 VM 并使用 SSL 绑定配置 NGINXInject the certificate into the VM and configure NGINX with an SSL binding

请访问以下链接查看预先生成的虚拟机脚本示例。Follow this link to see pre-built virtual machine script samples.