Options to Configure the Azure Management Certificate for Azure Burst Deployments

Applies To: HPC Pack 2016, Microsoft HPC Pack 2012, Microsoft HPC Pack 2012 R2

Before you can deploy Azure nodes in your Windows HPC cluster, a management certificate must be uploaded to your Azure subscription. A corresponding certificate must be configured on the head node computer (or on each of the head node computers, if the head node is configured for high availability). For certain scenarios with some versions of HPC Pack, a certificate must also be configured on a client computer that is used to manage the cluster and that needs a connection to Azure.

Overview

The following table summarizes the required configuration for the management certificate for Azure node deployments. The exact configuration steps required depend on the source of the management certificate, the version of HPC Pack running on the cluster, and your cluster configuration. See the scenarios in the rest of this topic for examples.

For more information about the Azure subscription and the options to obtain a management certificate for deployments of Azure nodes with HPC Pack, see Requirements to Add Azure Nodes with Microsoft HPC Pack.

To import or export certificates to certificate stores on a computer, an account with appropriate rights and permissions must be used. For general information about using the Certificates snap-in to perform certificate export and import, see the documentation for your version of Windows Server.

Scenario 1: Configure the Default Microsoft HPC Azure Management certificate

In versions of HPC Pack before HPC Pack 2016, the Default Microsoft HPC Azure Management certificate is generated automatically on the head node (or head nodes) when HPC Pack is installed. This certificate is self-signed and unique to your installation of HPC Pack. This certificate is provided for testing purposes and proof-of-concept deployments. It simplifies but does not eliminate all certificate configuration tasks for Azure node deployments.

At installation, the Default Microsoft HPC Azure Management certificate is automatically imported to the required certificate stores for the local computer, and the %CCP_HOME%\bin\hpccert.cer file is generated. This file can then be uploaded to the Azure subscription by using the Azure portal or other tools for Azure. The additional tasks that you have to perform to use this certificate are described in this section.

The following figure shows the two certificate stores on the head node (or head nodes) where the Default Microsoft HPC Azure Management certificate is imported automatically when HPC Pack (starting with HPC Pack 2008 R2 with SP3) is installed.

The green arrows at the right of the figure show the following additional certificate stores where the HPC administrator needs to manually import the certificate for HPC Pack 2008 R2 with SP3, HPC Pack 2008 R2 with SP4, or HPC Pack 2012 RTM:

1. On each head node, import the certificate (with a private key) to the Current User\Personal store.

2. On a client computer used to manage the cluster and that needs a connection to Azure, import the certificate (with a private key) to the Current User\Personal store, and import the certificate in CER format (without a key) to the Current User\Trusted Root Certification Authorities store. If you do not use a client computer to manage the cluster, these steps are not necessary.

Use the following procedures to complete these tasks if they are needed.

To upload the Default Microsoft HPC Azure Management certificate to the Azure subscription

1. Sign in to the Azure portal.

2. Click Subscriptions > your_subscription_name.

3. Click Management certificates > Upload.

4. Browse for the file %CCP_HOME%\bin\hpccert.cer.

To export the Default HPC Azure Management Certificate in PFX format by using the Certificates snap-in

1. On the head node, start the Microsoft Management Console. For example, at a command prompt, type mmc.

2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

3. In Available snap-ins, click Certificates, and then click Add.

4. Select Computer account, and then click Next.

   Important

   
   For this procedure you must select Computer account. Do not select another option on this page.

5. Select Local computer, and then click Finish. Click OK.

6. In the console tree, expand Certificates, expand Personal, and then click Certificates.

7. In the details pane, click Default Microsoft HPC Azure Management.

8. To export the certificate in PFX format, do the following:

   1. On the Action menu, point to All Tasks, and then click Export. The Certificate Export Wizard appears. Click Next.

   2. On the Export Private Key page, click Yes, export the private key. Click Next.

   3. On the Export File Format page, select Personal Information Exchange – PKCS #12 (.PFX). Click Next.

   4. On the Password page, type and confirm the password that you want to use to encrypt the private key. Click Next.

   5. Follow the pages of the wizard to export the certificate in PFX format.

   Important

   
   A PFX formatted file that is exported is password protected. However, it should always be stored in a secure location.

To import the Default Windows Microsoft HPC Azure Management certificate to the Current User\Personal store on the head node

1. On the head node, start the Microsoft Management Console. For example, at a command prompt, type mmc.

2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

3. In Available snap-ins, click Certificates, and then click Add.

4. Select My user account, and then click Finish.

5. In the console tree, expand Certificates – Current User, and then expand Personal.

6. To import the PFX formatted certificate, right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

7. Follow the pages of the wizard to import the .pfx file to the Personal store.

   Important

   
   If you want, select the option to mark the key as exportable. This allows other HPC administrators to export the certificate with the private key at a later date. If you do not want to mark the key as exportable, store the .pfx file for the management certificate in a secure location and make it available to other HPC administrators when needed.

   After the certificate is imported, it appears in the details pane in the Certificates snap-in. You can double-click the certificate to check its status and to view details such as the thumbprint.

To import the Default Windows Microsoft HPC Azure Management certificate to certificate stores on a client computer used to administer the cluster

1. Log on to the client computer using the appropriate cluster administrator account.

2. Start the Certificates snap-in to manage user certificates. For example, at a command prompt, type certmgr.msc.

3. To import the PFX formatted certificate to the Current User\Personal store, do the following:

   1. In the console tree, expand Certificates, and then expand Personal.

   2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

   3. Follow the pages of the wizard to import the .pfx file to the Personal store.

   Warning

   
   As a security best practice, unless you have a specific reason to do it, do not select the option to mark the key as exportable when you import it to the Current User\Personal store.

4. To import the CER formatted certificate to the Current User\Trusted Root Certification Authorities store, do the following:

   1. In the console tree, expand Certificates, and then expand Trusted Root Certification Authorities.

   2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

   3. Follow the pages of the wizard to import the hpccert.cer file to the Trusted Root Certification Authorities store.

Additional considerations

• If you uninstall HPC Pack, the Default Microsoft HPC Azure Management certificate on the head node is not deleted. Both the hpccert.cer file and the Default Microsoft HPC Azure Management certificates in the certificate stores on the head node remain after uninstallation. If you reinstall HPC Pack at a later time, the Default Microsoft HPC Azure Management is not regenerated.

Scenario 2: Configure a self-signed certificate or a certificate from an unknown certification authority

To use your own self-signed certificate, or a certificate issued by a certification authority (CA) that is not already trusted, the HPC administrator for a cluster created with HPC Pack 2008 R2 with SP3, HPC Pack 2008 R2 with SP4, or HPC Pack 2012 RTM needs to perform all the manual configuration steps shown by the green arrows in the following figure on each head node and (if necessary) on any client computer that is used to manage the cluster.

For example, a self-signed X.509 v3 certificate can be created by using the makecert.exe tool, which is automatically installed with certain versions of Microsoft Visual Studio and the Windows SDK. The resulting certificate can then be imported to the necessary certificate stores on the head node and on client computers. Use the following procedures to complete these tasks if they are needed.

To create a self-signed certificate by using makecert

• Open a Visual Studio command prompt or a Windows SDK command prompt.

• To create a self-signed X.509 certificate with key length 2048, install it in the Current User\Personal certificate store with the name WinAzureHPCCert, and create a corresponding CER file HPCcert.cer, type a command similar to the following:

  makecert -r -pe -a sha1 -n "CN=WinAzureHPCCert" -ss My -len 2048 -sp "Microsoft Enhanced RSA and AES Cryptographic Provider" -sy 24 HPCcert.cer  
  

To upload the self-signed certificate to the Azure subscription

1. Sign in to the classic portal.

2. Click Settings, click Management Certificates, and then click Upload

3. Browse for the file HPCcert.cer (the certificate file that you created by using makecert.exe).

To export the self-signed certificate in PFX format by using the Certificates snap-in

1. On the computer where you generated the self-signed certificate, start the Microsoft Management Console. For example, at a command prompt, type mmc.

2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

3. In Available snap-ins, click Certificates, and then click Add.

4. Select My user account, and then click Finish. Click OK.

5. In the console tree, expand Certificates, expand Personal, and then click Certificates.

6. In the details pane, click WinAzureHPCCert (the name of the self-signed certificate that you created by using makecert.exe).

7. To export the certificate in PFX format, do the following:

   1. On the Action menu, point to All Tasks, and then click Export. The Certificate Export Wizard appears. Click Next.

   2. On the Export Private Key page, click Yes, export the private key. Click Next.

   3. On the Export File Format page, select Personal Information Exchange – PKCS #12 (.PFX). Click Next.

   4. On the Password page, type and confirm the password that you want to use to encrypt the private key. Click Next.

   5. Follow the pages of the wizard to export the certificate in PFX format.

   Important

   
   A PFX formatted file that is exported is password protected. However, it should always be stored in a secure location.

To import the self-signed certificate to certificate stores on the head node

1. On the head node, start the Microsoft Management Console. For example, at a command prompt, type mmc.

2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

3. In Available snap-ins, click Certificates, and then click Add.

4. Select Computer account, and then click Next.

5. Select Local computer, and then click Finish.

6. In Available snap-ins, click Certificates, and then click Add.

7. Select My user account, and then click Finish. Click OK.

8. To import the PFX formatted certificate to the Local Computer\Personal store, do the following:

   1. In the console tree, expand Certificates (Local Computer), and then expand Personal.

   2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

   3. Follow the pages of the wizard to import the .pfx file to the Personal store.

   Important

   
   If you want, select the option to mark the key as exportable. This allows other HPC administrators to export the certificate with the private key at a later date. If you do not want to mark the key as exportable, store the .pfx file for the management certificate in a secure location and make it available to other HPC administrators when needed.

   After the certificate is imported, it appears in the details pane in the Certificates snap-in. You can double-click the certificate to check its status and to view details such as the thumbprint.

9. To import the CER formatted certificate to the Local Computer\Trusted Root Certification Authorities store, do the following:

   1. In the console tree, expand Certificates (Local Computer, and then expand Trusted Root Certification Authorities.

   2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

   3. Follow the pages of the wizard to import the .cer file (without the private key) to the Trusted Root Certification Authorities store.

10. To import the PFX formatted certificate to the Current User\Personal store, do the following:

    1. In the console tree, expand Certificates – Current User, and then expand Personal.

    2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

    3. Follow the pages of the wizard to import the .pfx file (with the private key) to the Personal store.

To import the self-signed certificate to certificate stores on a client computer

1. Log on to the client computer using the appropriate HPC administrator account.

2. Start Certificate Manager. For example, at a command prompt, type certmgr.msc.

3. In the console tree, expand Certificates, and then expand Personal.

4. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

5. Follow the pages of the wizard to import the .pfx file (with the private key) to the Personal store.

6. In the console tree, expand Certificates, and then expand Trusted Root Certification Authorities.

7. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

8. Follow the pages of the wizard to import the .cer file (without the private key) to the Trusted Root Certification Authorities store.

Scenario 3: Configure a certificate from a trusted CA

To use a certificate issued by a public or enterprise CA that is already trusted, the HPC administrator for a cluster created with HPC Pack 2008 R2 with SP3, HPC Pack 2008 R2 with SP4, or HPC Pack 2012 RTM performs the manual configuration steps shown by the green arrows in the following figure on each head node and (if necessary) on any client computer that is used to manage the cluster.

Use the following procedures to complete these tasks.

To export the trusted certificate in PFX format and in CER format by using the Certificates snap-in

1. On the head node computer, start the Microsoft Management Console. For example, at a command prompt, type mmc.

2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

3. In Available snap-ins, click Certificates, and then click Add.

4. Select Computer account, and then click Next. Click OK.

5. Select Local computer, and then click Finish. Click OK.

6. In the console tree, expand Certificates, expand Trusted Root Certification Authorities, and then click Certificates.

7. In the details pane, click the trusted certificate.

8. To export the certificate in PFX format, do the following:

   1. On the Action menu, point to All Tasks, and then click Export. The Certificate Export Wizard appears. Click Next.

   2. On the Export Private Key page, click Yes, export the private key. Click Next.

   3. On the Export File Format page, select Personal Information Exchange – PKCS #12 (.PFX). Click Next.

   4. On the Password page, type and confirm the password that you want to use to encrypt the private key. Click Next.

   5. Follow the pages of the wizard to export the certificate in PFX format.

   Important

   
   A PFX formatted file that is exported is password protected. However, it should always be stored in a secure location.

9. To export the certificate in CER format, do the following:

   1. On the Action menu, point to All Tasks, and then click Export. The Certificate Export Wizard appears. Click Next.

   2. On the Export Private Key page, click No, do not export the private key. Click Next.

   3. On the Export File Format page, select DER encoded binary X.509 (.CER). Click Next.

   4. Follow the pages of the wizard to export the certificate in CER format.

To upload the certificate to the Azure subscription

1. Sign in to the classic portal.

2. Click Settings, click Management Certificates, and then click Upload

3. Browse for the .cer file that you exported previously from the Trusted Root Certification Authorities store.

To import the certificate to certificate stores on the head node

1. On the head node, start the Microsoft Management Console. For example, at a command prompt, type mmc.

2. On the File menu, click Add/Remove Snap-in. The Add or Remove Snap-ins dialog box appears.

3. In Available snap-ins, click Certificates, and then click Add.

4. Select Computer account, and then click Next.

5. Select Local computer, and then click Finish.

6. In Available snap-ins, click Certificates, and then click Add.

7. Select My user account, and then click Finish. Click OK.

8. To import the PFX formatted certificate to the Local Computer\Personal store, do the following:

   1. In the console tree, expand Certificates (Local Computer), and then expand Personal.

   2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

   3. Follow the pages of the wizard to import the .pfx file to the Personal store.

   Important

   
   If you want, select the option to mark the key as exportable. This allows other HPC administrators to export the certificate with the private key at a later date. If you do not want to mark the key as exportable, store the .pfx file for the management certificate in a secure location and make it available to other HPC administrators when needed.

   After the certificate is imported, it appears in the details pane in the Certificates snap-in. You can double-click the certificate to check its status and to view details such as the thumbprint.

9. To import the PFX formatted certificate to the Current User\Personal store, do the following:

   1. In the console tree, expand Certificates – Current User, and then expand Personal.

   2. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

   3. Follow the pages of the wizard to import the .pfx file (with the private key) to the Personal store.

To import the certificate to certificate stores on a client computer

1. Log on to the client computer using the appropriate HPC administrator account.

2. Start Certificate Manager. For example, at a command prompt, type certmgr.msc.

3. In the console tree, expand Certificates, and then expand Personal.

4. Right-click Certificates, point to All Tasks, and then click Import. The Certificate Import Wizard appears.

5. Follow the pages of the wizard to import the .pfx file (with the private key) to the Personal store.

Troubleshoot certificate problems

The following table lists some common problems when configuring a management certificate in an Azure node template or when deploying Azure nodes, along with possible causes and resolution steps.

See Also

Burst to Azure Worker Instances with Microsoft HPC Pack