Generating and registering Azure certificate credentials

You need to generate and register the certificate received by Cloudera to use certificate-based authentication with Azure.

Create a new Azure credential and obtain the generated certificate using the CDP CLI environment create-azure-credential command.

$ cdp environments create-azure-credential --credential-name cert-example --app-based authenticationType=CERTIFICATE
{
    "credential": {
        "credentialName": "cert-example",
        "crn": "crn:cdp:environments:us-west-1::credential:",
        "cloudPlatform": "AZURE",
        "description": "",
        "azureCredentialProperties": {
            "authenticationType": "CERTIFICATE",
            "certificate": {
                "status": "KEY_GENERATED",
                "expiration": "1732711849000",
                "expirationDate": "2024-11-27T12:50:49+00:00",
                "sha512": "",
                "base64": ""
            }
        }
    }
}

The generated certificate is returned as a base64 string in the output.

Decode the generated certificate and save it in a file.

Create new app credentials in Azure using the saved certificate credentials. You can create the credential either in the Azure portal or you can use Azure CLI as shown in the following example:

$ az ad sp create-for-rbac  --name cert-creds-example --role Contributor  --scopes /subscriptions/ --cert @certificate.pem
Certificate expires 2024-11-27 12:50:49+00:00. Adjusting key credential end date to match.
Creating 'Contributor' role assignment under scope '/subscriptions/'
The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli
{
  "appId": "",
  "displayName": "cert-creds-example",
  "password": null,
  "tenant": ""
}
```

Update the certificate credentials with the appId, subscriptionId, and tenantId to activate it as shown in the following example:

$ cdp environments update-azure-credential --credential-name cert-example --subscription-id  --tenant-id  --app-based authenticationType=CERTIFICATE,applicationId=
{
    "credential": {
        "credentialName": "cert-example",
        "crn": "crn:cdp:environments:us-west-1::credential:",
        "cloudPlatform": "AZURE",
        "description": "",
        "azureCredentialProperties": {
            "subscriptionId": "",
            "tenantId": "",
            "appId": "",
            "authenticationType": "CERTIFICATE",
            "certificate": {
                "status": "ACTIVE",
                "expiration": "1732711849000",
                "expirationDate": "2024-11-27T12:50:49+00:00",
                "sha512": "",
                "base64": ""
            }
        }
    }
}

The certificate status is now ACTIVE.

You can use the credential to create Cloudera environments.