Scenarios to Configure the Windows Azure Management Certificate for Windows Azure Burst Deployments

Applies To: Microsoft HPC Pack 2008 R2, Microsoft HPC Pack 2012, Microsoft HPC Pack 2012 R2, Windows HPC Server 2008 R2

Before you can deploy Windows Azure nodes in your Windows HPC cluster, a management certificate must be uploaded to your Windows Azure subscription. A corresponding certificate must be configured on the head node computer (or head node computers, if the head node is configured for high availability). For certain scenarios with some versions of HPC Pack, a certificate must also be configured on a client computer that is used to manage the cluster and that needs a connection to Windows Azure.

In this topic:

  • Overview

  • Scenario 1: Configure the Default Microsoft HPC Azure Management certificate

  • Scenario 2: Configure a self-signed certificate or a certificate from an unknown certification authority

  • Scenario 3: Configure a certificate from a trusted CA

  • Troubleshoot certificate problems

Overview

The following table summarizes the required configuration for the management certificate for Windows Azure node deployments. The exact configuration steps required will depend on the source of the management certificate, the version of HPC Pack running on the cluster, and your cluster configuration. See the scenarios in the rest of this topic for examples.

Location Certificate store Type

Windows Azure subscription

Subscription settings

Certificate only (.cer)

Head node(s)

Local Computer\Personal

Certificate with private key (.pfx)

Local Computer\Trusted Root Certification Authorities

Certificate only (.cer)

Current User\Personal

Note

Starting with HPC Pack 2012 with SP1, this configuration is not needed.

Certificate with private key (.pfx)

Client computer

Current User\Personal

Note

Starting with HPC Pack 2012 with SP1, this configuration is not needed.

Certificate with private key (.pfx)

Current User\Trusted Root Certification Authorities

Note

Starting with HPC Pack 2012 with SP1, this configuration is not needed.

Certificate only (.cer)

Note

If you plan deployments of Windows Azure nodes with more than one Windows Azure subscription, make sure that you configure all the management certificates that you need.

For more information about the Windows Azure subscription and the options to obtain a management certificate for deployments of Windows Azure nodes with HPC Pack, see Requirements to Add Windows Azure Nodes with Microsoft HPC Pack.

To import or export certificates to certificate stores on a computer, an account with appropriate rights and permissions must be used. For general information about using the Certificates snap-in to perform certificate export and import, see Certificates in the TechNet Library.

Scenario 1: Configure the Default Microsoft HPC Azure Management certificate

The Default Microsoft HPC Azure Management certificate is generated automatically on the head node (or head nodes) when HPC Pack is installed. This certificate is self-signed and unique to your installation of HPC Pack. This certificate is provided for testing purposes and proof-of-concept deployments. It simplifies but does not eliminate all certificate configuration tasks for Windows Azure node deployments.

At installation, the Default Microsoft HPC Azure Management certificate is automatically imported to the required certificate stores for the local computer, and the %CCP_HOME%\bin\hpccert.cer file is generated. This file can then be uploaded to the Windows Azure subscription by using the Windows Azure Management Portal or other tools for Windows Azure. The additional tasks that you have to perform to use this certificate are described in this section.

The following figure shows the two certificate stores on the head node (or head nodes) where the Default Microsoft HPC Azure Management certificate is imported automatically when HPC Pack (starting with HPC Pack 2008 R2 with SP3) is installed.

Configuration of Default Management Certificate

The green arrows at the right of the figure show the following additional certificate stores where the HPC administrator needs to manually import the certificate for HPC Pack 2008 R2 with SP3, HPC Pack 2008 R2 with SP4, or HPC Pack 2012 RTM:

  1. On each head node, import the certificate (with a private key) to the Current User\Personal store.

  2. On a client computer used to manage the cluster and that needs a connection to Windows Azure, import the certificate (with a private key) to the Current User\Personal store, and import the certificate in CER format (without a key) to the Current User\Trusted Root Certification Authorities store. If you do not use a client computer to manage the cluster, these steps are not necessary.

Use the following procedures to complete these tasks if they are needed.

Note

  • If you are running at least HPC Pack 2012 with SP1, the Default Microsoft HPC Azure Management is automatically imported to the necessary certificate stores on the head node. No further configuration on the head node is needed, and no configuration on a client computer is needed. The certificate only needs to be uploaded to the Windows Azure subscription.

  • If you are running HPC Pack 2008 R2 with SP1 or HPC Pack 2008 R2 with SP2, the Default Microsoft HPC Azure Management, with its private key, is automatically imported only to the Local Computer\Trusted Root Certification Authorities store on the head node. It is not required to import the certificate (with a private key) to additional stores on the head node. However, as a security best practice, it is recommended that you update your private key certificate configurations to those expected starting with HPC Pack 2008 R2 with SP3.

Important

  • Only use the Certificates snap-in to import and export the certificate. Do not install the certificate by opening the file in Windows Explorer.

  • You cannot copy the certificate from a certificate store on one computer and paste it in a store on another computer.

To upload the Default Microsoft HPC Azure Management certificate to the Windows Azure subscription

  1. Sign in to the Windows Azure Management Portal.

  2. Click Settings, click Management Certificates, and then click Upload.

  3. Browse for the file %CCP_HOME%\bin\hpccert.cer.

To export the Default HPC Azure Management Certificate in PFX format by using the Certificates snap-in

  1. On the head node, start the Microsoft Management Console. For example, at a command prompt, type mmc.

  2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

  3. In Available snap-ins, click Certificates, and then click Add.

  4. Select Computer account, and then click Next.

    Important

    For this procedure you must select Computer account. Do not select another option on this page.

  5. Select Local computer, and then click Finish. Click OK.

  6. In the console tree, expand Certificates, expand Personal, and then click Certificates.

  7. In the details pane, click Default Microsoft HPC Azure Management.

  8. To export the certificate in PFX format, do the following:

    1. On the Action menu, point to All Tasks, and then click Export. The Certificate Export Wizard appears. Click Next.

    2. On the Export Private Key page, click Yes, export the private key. Click Next.

    3. On the Export File Format page, select Personal Information Exchange – PKCS #12 (.PFX). Click Next.

    4. On the Password page, type and confirm the password that you want to use to encrypt the private key. Click Next.

    5. Follow the pages of the wizard to export the certificate in PFX format.

    Important

    A PFX formatted file that is exported is password protected. However, it should always be stored in a secure location.

To import the Default Windows Microsoft HPC Azure Management certificate to the Current User\Personal store on the head node

  1. On the head node, start the Microsoft Management Console. For example, at a command prompt, type mmc.

  2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

  3. In Available snap-ins, click Certificates, and then click Add.

  4. Select My user account, and then click Finish.

  5. In the console tree, expand Certificates – Current User, and then expand Personal.

  6. To import the PFX formatted certificate, right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

  7. Follow the pages of the wizard to import the .pfx file to the Personal store.

    Important

    If you want, select the option to mark the key as exportable. This allows other HPC administrators to export the certificate with the private key at a later date. If you do not want to mark the key as exportable, store the .pfx file for the management certificate in a secure location and make it available to other HPC administrators when needed.

    After the certificate is imported, it appears in the details pane in the Certificates snap-in. You can double-click the certificate to check its status and to view details such as the thumbprint.

To import the Default Windows Microsoft HPC Azure Management certificate to certificate stores on a client computer used to administer the cluster

  1. Log on to the client computer using the appropriate cluster administrator account.

  2. Start the Certificates snap-in to manage user certificates. For example, at a command prompt, type certmgr.msc.

  3. To import the PFX formatted certificate to the Current User\Personal store, do the following:

    1. In the console tree, expand Certificates, and then expand Personal.

    2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

    3. Follow the pages of the wizard to import the .pfx file to the Personal store.

    Warning

    As a security best practice, unless you have a specific reason to do it, do not select the option to mark the key as exportable when you import it to the Current User\Personal store.

  4. To import the CER formatted certificate to the Current User\Trusted Root Certification Authorities store, do the following:

    1. In the console tree, expand Certificates, and then expand Trusted Root Certification Authorities.

    2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

    3. Follow the pages of the wizard to import the hpccert.cer file to the Trusted Root Certification Authorities store.

Additional considerations

  • If you upgrade from HPC Pack 2008 R2 with SP2 to HPC Pack 2008 R2 with SP3, the Default Microsoft HPC Azure Management certificate is not moved from a store where it was previously installed.

  • If you uninstall HPC Pack, the Default Microsoft HPC Azure Management certificate on the head node is not deleted. Both the hpccert.cer file and the Default Microsoft HPC Azure Management certificates in the certificate stores on the head node remain after uninstallation. If you reinstall HPC Pack at a later time, the Default Microsoft HPC Azure Management is not regenerated.

Scenario 2: Configure a self-signed certificate or a certificate from an unknown certification authority

To use a self-signed certificate other than the Default Microsoft HPC Azure Management certificate, or a certificate issued by a certification authority (CA) that is not already trusted, the HPC administrator for a cluster created with HPC Pack 2008 R2 with SP3, HPC Pack 2008 R2 with SP4, or HPC Pack 2012 RTM needs to perform all the manual configuration steps shown by the green arrows in the following figure on each head node and (if necessary) on any client computer that is used to manage the cluster.

Note

Starting with HPC Pack 2012 with SP1, the self-signed certificate only needs to be imported in the Local Computer\Personal and Local Computer\Trusted Root CAs stores.

Certificate stores for management certificate

For example, a self-signed X.509 v3 certificate can be created by using the makecert.exe tool, which is automatically installed with Visual Studio and with the Windows SDK. The resulting certificate can then be imported to the necessary certificate stores on the head node and on client computers. Use the following procedures to complete these tasks if they are needed.

Important

  • Only use the Certificates snap-in to import and export the certificate. Do not install the certificate by opening the file in Windows Explorer.

  • You cannot copy the certificate from a certificate store on one computer and paste it in a store on another computer.

To create a self-signed certificate by using makecert

  • Open a Visual Studio command prompt or a Windows SDK command prompt.

  • To create a self-signed X.509 certificate with key length 2048, install it in the Current User\Personal certificate store with the name WinAzureHPCCert, and create a corresponding CER file HPCcert.cer, type a command similar to the following:

    makecert -r -pe -a sha1 -n "CN=WinAzureHPCCert" -ss My -len 2048 -sp "Microsoft Enhanced RSA and AES Cryptographic Provider" -sy 24 HPCcert.cer
    

    Note

    For more information about the command options for makecert.exe and running the tool, see Makecert.exe (Certificate Creation Tool).

To upload the self-signed certificate to the Windows Azure subscription

  1. Sign in to the Windows Azure Management Portal.

  2. Click Settings, click Management Certificates, and then click Upload

  3. Browse for the file HPCcert.cer (the certificate file that you created by using makecert.exe).

To export the self-signed certificate in PFX format by using the Certificates snap-in

  1. On the computer where you generated the self-signed certificate, start the Microsoft Management Console. For example, at a command prompt, type mmc.

  2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

  3. In Available snap-ins, click Certificates, and then click Add.

  4. Select My user account, and then click Finish. Click OK.

  5. In the console tree, expand Certificates, expand Personal, and then click Certificates.

  6. In the details pane, click WinAzureHPCCert (the name of the self-signed certificate that you created by using makecert.exe).

  7. To export the certificate in PFX format, do the following:

    1. On the Action menu, point to All Tasks, and then click Export. The Certificate Export Wizard appears. Click Next.

    2. On the Export Private Key page, click Yes, export the private key. Click Next.

    3. On the Export File Format page, select Personal Information Exchange – PKCS #12 (.PFX). Click Next.

    4. On the Password page, type and confirm the password that you want to use to encrypt the private key. Click Next.

    5. Follow the pages of the wizard to export the certificate in PFX format.

    Important

    A PFX formatted file that is exported is password protected. However, it should always be stored in a secure location.

To import the self-signed certificate to certificate stores on the head node

  1. On the head node, start the Microsoft Management Console. For example, at a command prompt, type mmc.

  2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

  3. In Available snap-ins, click Certificates, and then click Add.

  4. Select Computer account, and then click Next.

  5. Select Local computer, and then click Finish.

  6. In Available snap-ins, click Certificates, and then click Add.

  7. Select My user account, and then click Finish. Click OK.

  8. To import the PFX formatted certificate to the Local Computer\Personal store, do the following:

    1. In the console tree, expand Certificates (Local Computer), and then expand Personal.

    2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

    3. Follow the pages of the wizard to import the .pfx file to the Personal store.

    Important

    If you want, select the option to mark the key as exportable. This allows other HPC administrators to export the certificate with the private key at a later date. If you do not want to mark the key as exportable, store the .pfx file for the management certificate in a secure location and make it available to other HPC administrators when needed.

    After the certificate is imported, it appears in the details pane in the Certificates snap-in. You can double-click the certificate to check its status and to view details such as the thumbprint.

  9. To import the CER formatted certificate to the Local Computer\Trusted Root Certification Authorities store, do the following:

    1. In the console tree, expand Certificates (Local Computer, and then expand Trusted Root Certification Authorities.

    2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

    3. Follow the pages of the wizard to import the .cer file (without the private key) to the Trusted Root Certification Authorities store.

  10. To import the PFX formatted certificate to the Current User\Personal store, do the following:

    1. In the console tree, expand Certificates – Current User, and then expand Personal.

    2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

    3. Follow the pages of the wizard to import the .pfx file (with the private key) to the Personal store.

To import the self-signed certificate to certificate stores on a client computer

  1. Log on to the client computer using the appropriate HPC administrator account.

  2. Start Certificate Manager. For example, at a command prompt, type certmgr.msc.

  3. In the console tree, expand Certificates, and then expand Personal.

  4. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

  5. Follow the pages of the wizard to import the .pfx file (with the private key) to the Personal store.

  6. In the console tree, expand Certificates, and then expand Trusted Root Certification Authorities.

  7. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

  8. Follow the pages of the wizard to import the .cer file (without the private key) to the Trusted Root Certification Authorities store.

Scenario 3: Configure a certificate from a trusted CA

To use a certificate issued by a public or enterprise CA that is already trusted, the HPC administrator for a cluster created with HPC Pack 2008 R2 with SP3, HPC Pack 2008 R2 with SP4, or HPC Pack 2012 RTM performs the manual configuration steps shown by the green arrows in the following figure on each head node and (if necessary) on any client computer that is used to manage the cluster.

Note

  • Because the certificate is issued by a trusted CA, a trusted root certificate should already be configured on the computers, and it should not be necessary to import a certificate to the Trusted Root Certification Authorities store.

  • Starting with HPC Pack 2012 with SP1, the trusted certificate only needs to be imported in the Local Computer\Personal store.

Certificate stores for management certificate

Use the following procedures to complete these tasks.

Important

  • Only use the Certificates snap-in to import and export the certificate. Do not install the certificate by opening the file in Windows Explorer.

  • You cannot copy the certificate from a certificate store on one computer and paste it in a store on another computer.

To export the trusted certificate in PFX format and in CER format by using the Certificates snap-in

  1. On the head node computer, start the Microsoft Management Console. For example, at a command prompt, type mmc.

  2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

  3. In Available snap-ins, click Certificates, and then click Add.

  4. Select Computer account, and then click Next. Click OK.

  5. Select Local computer, and then click Finish. Click OK.

  6. In the console tree, expand Certificates, expand Trusted Root Certification Authorities, and then click Certificates.

  7. In the details pane, click the trusted certificate.

  8. To export the certificate in PFX format, do the following:

    1. On the Action menu, point to All Tasks, and then click Export. The Certificate Export Wizard appears. Click Next.

    2. On the Export Private Key page, click Yes, export the private key. Click Next.

    3. On the Export File Format page, select Personal Information Exchange – PKCS #12 (.PFX). Click Next.

    4. On the Password page, type and confirm the password that you want to use to encrypt the private key. Click Next.

    5. Follow the pages of the wizard to export the certificate in PFX format.

    Important

    A PFX formatted file that is exported is password protected. However, it should always be stored in a secure location.

  9. To export the certificate in CER format, do the following:

    1. On the Action menu, point to All Tasks, and then click Export. The Certificate Export Wizard appears. Click Next.

    2. On the Export Private Key page, click No, do not export the private key. Click Next.

    3. On the Export File Format page, select DER encoded binary X.509 (.CER). Click Next.

    4. Follow the pages of the wizard to export the certificate in CER format.

To upload the certificate to the Windows Azure subscription

  1. Sign in to the Windows Azure Management Portal.

  2. Click Settings, click Management Certificates, and then click Upload

  3. Browse for the .cer file that you exported previously from the Trusted Root Certification Authorities store.

To import the certificate to certificate stores on the head node

  1. On the head node, start the Microsoft Management Console. For example, at a command prompt, type mmc.

  2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

  3. In Available snap-ins, click Certificates, and then click Add.

  4. Select Computer account, and then click Next.

  5. Select Local computer, and then click Finish.

  6. In Available snap-ins, click Certificates, and then click Add.

  7. Select My user account, and then click Finish. Click OK.

  8. To import the PFX formatted certificate to the Local Computer\Personal store, do the following:

    1. In the console tree, expand Certificates (Local Computer), and then expand Personal.

    2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

    3. Follow the pages of the wizard to import the .pfx file to the Personal store.

    Important

    If you want, select the option to mark the key as exportable. This allows other HPC administrators to export the certificate with the private key at a later date. If you do not want to mark the key as exportable, store the .pfx file for the management certificate in a secure location and make it available to other HPC administrators when needed.

    After the certificate is imported, it appears in the details pane in the Certificates snap-in. You can double-click the certificate to check its status and to view details such as the thumbprint.

  9. To import the PFX formatted certificate to the Current User\Personal store, do the following:

    1. In the console tree, expand Certificates – Current User, and then expand Personal.

    2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

    3. Follow the pages of the wizard to import the .pfx file (with the private key) to the Personal store.

To import the certificate to certificate stores on a client computer

  1. Log on to the client computer using the appropriate HPC administrator account.

  2. Start Certificate Manager. For example, at a command prompt, type certmgr.msc.

  3. In the console tree, expand Certificates, and then expand Personal.

  4. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

  5. Follow the pages of the wizard to import the .pfx file (with the private key) to the Personal store.

Troubleshoot certificate problems

The following table lists some common problems when configuring a management certificate in a Windows Azure node template or when deploying Windows Azure nodes, along with possible causes and resolution steps.

Problem Possible causes Resolution

No certificate available when browsing for management certificates

  • Private key certificate is not imported to a required certificate store

  • Certification authority of root certificate is not trusted

Import the certificate to all required certificate stores, as described earlier in this topic. .

Note

The required certificate stores in HPC Pack 2008 R2 with SP1 or HPC Pack 2008 R2 with SP2 differ from those in later versions of HPC Pack. More recent versions of HPC Pack provide a more secure configuration.

There was a problem with the certificate with thumbprint: <thumbprint> error after entering a certificate thumbprint or selecting a certificate

  • Certificate thumbprint is not properly formatted or does not correspond to a certificate in a required certificate store

  • Certificate chain is broken

  • Certificate is not properly imported into a certificate store

  • Certificate is expired

  • Ensure that the certificate thumbprint contains the required number of characters, does not contain spaces, and corresponds to the proper authentication certificate.

  • Verify that the certification authority that issued the certificate is trusted. If necessary, establish the trust relationship. To do this on the head node, import the certificate without its private key (the certificate in CER format) to the Local Computer\Trusted Root Certification Authorities store.

  • In the Certificates snap-in, double-click the certificate and check that the certificate does not display configuration errors such as The CA Root certificate is not trusted or The certificate has expired or is not yet valid.

The remote server returned an error: (403) Forbidden error message after entering a valid certificate thumbprint or browsing to select a certificate.

Certificate is not added to the Windows Azure subscription

Upload the certificate to the Windows Azure subscription by using the Windows Azure Management Portal.

See Also

Concepts

Burst to Windows Azure with Microsoft HPC Pack