I have a worker role that is used to provision databases. In order to do this it has to hit the Azure Management API and to do this it requires a certificate.
You can store certificates in the portal against the subscription (Settings tab) or against individual cloud services. Where should the certificate be stored?