Azure Key Vault is a cloud service that provides secure storage and automated management of certificates used throughout a cloud application. Multiple certificates, and multiple versions of the same certificate, can be kept in the Azure Key Vault. Each certificate in the vault has a policy associated with it which controls the issuance and lifetime of the certificate, along with actions to be taken as certificates near expiry.
The Azure Key Vault certificates client library enables programmatically managing certificates, offering methods to create, update, list, and delete certificates, policies, issuers, and contacts. The library also supports managing pending certificate operations and management of deleted certificates.
Source code | Package (NuGet) | API reference documentation | Product documentation | Samples | Migration guide
Getting started Install the packageInstall the Azure Key Vault certificates client library for .NET with NuGet:
dotnet add package Azure.Security.KeyVault.Certificates
If you use the Azure CLI, replace <your-resource-group-name> and <your-key-vault-name> with your own, unique names:
az keyvault create --resource-group <your-resource-group-name> --name <your-key-vault-name>
In order to interact with the Azure Key Vault service, you'll need to create an instance of the CertificateClient class. You need a vault url, which you may see as "DNS Name" in the portal, and credentials to instantiate a client object.
The examples shown below use a DefaultAzureCredential, which is appropriate for most scenarios including local development and production environments. Additionally, we recommend using a managed identity for authentication in production environments. You can find more information on different ways of authenticating and their corresponding credential types in the Azure Identity documentation.
To use the DefaultAzureCredential provider shown below, or other credential providers provided with the Azure SDK, you must first install the Azure.Identity package:
dotnet add package Azure.Identity
Instantiate a DefaultAzureCredential to pass to the client. The same instance of a token credential can be used with multiple clients if they will be authenticating with the same identity.
// Create a new certificate client using the default credential from Azure.Identity using environment variables previously set,
// including AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID.
var client = new CertificateClient(vaultUri: new Uri(vaultUrl), credential: new DefaultAzureCredential());
A KeyVaultCertificate is the fundamental resource within Azure Key Vault. You'll use certificates to encrypt and verify encrypted or signed data.
With a CertificateClient you can get certificates from the vault, create new certificates and new versions of existing certificates, update certificate metadata, and delete certificates. You can also manage certificate issuers, contacts, and management policies of certificates. This is illustrated in the examples below.
We guarantee that all client instance methods are thread-safe and independent of each other (guideline). This ensures that the recommendation of reusing client instances is always safe, even across threads.
Additional conceptsClient options | Accessing the response | Long-running operations | Handling failures | Diagnostics | Mocking | Client lifetime
ExamplesThe Azure.Security.KeyVault.Certificates package supports synchronous and asynchronous APIs.
The following section provides several code snippets using the clientcreated above, covering some of the most common Azure Key Vault certificate service related tasks:
StartCreateCertificate creates a certificate to be stored in the Azure Key Vault. If a certificate with the same name already exists, then a new version of the certificate is created. When creating the certificate the user can specify the policy which controls the certificate lifetime. If no policy is specified the default policy will be used. The StartCreateCertificate operation returns a CertificateOperation. The following example creates a self-signed certificate with the default policy.
// Create a certificate. This starts a long running operation to create and sign the certificate.
CertificateOperation operation = client.StartCreateCertificate("MyCertificate", CertificatePolicy.Default);
// You can await the completion of the create certificate operation.
// You should run UpdateStatus in another thread or do other work like pumping messages between calls.
while (!operation.HasCompleted)
{
Thread.Sleep(2000);
operation.UpdateStatus();
}
KeyVaultCertificateWithPolicy certificate = operation.Value;
Retrieve a certificateNOTE: Depending on the certificate issuer and validation methods, certificate creation and signing can take an indeterminate amount of time. Users should only wait on certificate operations when the operation can be reasonably completed in the scope of the application, such as with self-signed certificates or issuers with well known response times.
GetCertificate retrieves the latest version of a certificate stored in the Azure Key Vault along with its CertificatePolicy.
KeyVaultCertificateWithPolicy certificateWithPolicy = client.GetCertificate("MyCertificate");
GetCertificateVersion retrieves a specific version of a certificate in the vault.
KeyVaultCertificate certificate = client.GetCertificateVersion(certificateWithPolicy.Name, certificateWithPolicy.Properties.Version);
UpdateCertificate updates a certificate stored in the Azure Key Vault.
CertificateProperties certificateProperties = new CertificateProperties(certificate.Id);
certificateProperties.Tags["key1"] = "value1";
KeyVaultCertificate updated = client.UpdateCertificateProperties(certificateProperties);
GetCertificates enumerates the certificates in the vault, returning select properties of the certificate. Sensitive fields of the certificate will not be returned. This operation requires the certificates/list permission.
Pageable<CertificateProperties> allCertificates = client.GetPropertiesOfCertificates();
foreach (CertificateProperties certificateProperties in allCertificates)
{
Console.WriteLine(certificateProperties.Name);
}
DeleteCertificate deletes all versions of a certificate stored in the Azure Key Vault. When soft-delete is not enabled for the Azure Key Vault, this operation permanently deletes the certificate. If soft delete is enabled the certificate is marked for deletion and can be optionally purged or recovered up until its scheduled purge date.
DeleteCertificateOperation operation = client.StartDeleteCertificate("MyCertificate");
// You only need to wait for completion if you want to purge or recover the certificate.
// You should call `UpdateStatus` in another thread or after doing additional work like pumping messages.
while (!operation.HasCompleted)
{
Thread.Sleep(2000);
operation.UpdateStatus();
}
DeletedCertificate certificate = operation.Value;
client.PurgeDeletedCertificate(certificate.Name);
The asynchronous APIs are identical to their synchronous counterparts, but return with the typical "Async" suffix for asynchronous methods and return a Task.
This example creates a certificate in the Azure Key Vault with the specified optional arguments.
// Create a certificate. This starts a long running operation to create and sign the certificate.
CertificateOperation operation = await client.StartCreateCertificateAsync("MyCertificate", CertificatePolicy.Default);
// You can await the completion of the create certificate operation.
KeyVaultCertificateWithPolicy certificate = await operation.WaitForCompletionAsync();
Listing certificate does not rely on awaiting the GetPropertiesOfCertificatesAsync method, but returns an AsyncPageable<CertificateProperties> that you can use with the await foreach statement:
AsyncPageable<CertificateProperties> allCertificates = client.GetPropertiesOfCertificatesAsync();
await foreach (CertificateProperties certificateProperties in allCertificates)
{
Console.WriteLine(certificateProperties.Name);
}
When deleting a certificate asynchronously before you purge it, you can await the WaitForCompletionAsync method on the operation. By default, this loops indefinitely but you can cancel it by passing a CancellationToken.
DeleteCertificateOperation operation = await client.StartDeleteCertificateAsync("MyCertificate");
// You only need to wait for completion if you want to purge or recover the certificate.
await operation.WaitForCompletionAsync();
DeletedCertificate certificate = operation.Value;
await client.PurgeDeletedCertificateAsync(certificate.Name);
See our troubleshooting guide for details on how to diagnose various failure scenarios.
GeneralWhen you interact with the Azure Key Vault certificates client library using the .NET SDK, errors returned by the service correspond to the same HTTP status codes returned for REST API requests.
For example, if you try to retrieve a Key that doesn't exist in your Azure Key Vault, a 404 error is returned, indicating Not Found.
try
{
KeyVaultCertificateWithPolicy certificateWithPolicy = client.GetCertificate("SomeCertificate");
}
catch (RequestFailedException ex)
{
Console.WriteLine(ex.ToString());
}
You will notice that additional information is logged, like the Client Request ID of the operation.
Message:
Azure.RequestFailedException : Service request failed.
Status: 404 (Not Found)
Content:
{"error":{"code":"CertificateNotFound","message":"Certificate not found: MyCertificate"}}
Headers:
Cache-Control: no-cache
Pragma: no-cache
Server: Microsoft-IIS/10.0
x-ms-keyvault-region: westus
x-ms-request-id: 625f870e-10ea-41e5-8380-282e5cf768f2
x-ms-keyvault-service-version: 1.1.0.866
x-ms-keyvault-network-info: addr=131.107.174.199;act_addr_fam=InterNetwork;
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000;includeSubDomains
X-Content-Type-Options: nosniff
Date: Tue, 18 Jun 2019 16:02:11 GMT
Content-Length: 75
Content-Type: application/json; charset=utf-8
Expires: -1
Several Azure Key Vault certificates client library samples are available to you in this GitHub repository. These samples provide example code for additional scenarios commonly encountered while working with Azure Key Vault:
Sample1_HelloWorld.md - for working with Azure Key Vault certificates, including:
Sample2_GetCertificates.md - Example code for working with Azure Key Vault certificates, including:
See the CONTRIBUTING.md for details on building, testing, and contributing to these libraries.
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4