Azure key 保管库证书 : the key was not found

Question

我正在尝试为现有 API 启用 Azure Key Vault 证书。我们在 Azure Key Vault 帐户中已拥有 secret 和 Azure Key Vault 证书。这是配置证书的代码:

 public static IWebHost BuildWebHost() =>
               WebHost.CreateDefaultBuilder()
                   .ConfigureAppConfiguration((context, config) =>
                   {
                       var env = context.HostingEnvironment;
                       config.SetBasePath(Directory.GetCurrentDirectory())
                            .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true);

                       var builtConfig = config.Build();
                       X509Store store = new X509Store(StoreName.My, StoreLocation.CurrentUser);
                       store.Open(OpenFlags.ReadOnly);
                       var cert = store.Certificates.Find(X509FindType.FindByThumbprint, builtConfig["AzureKeyVault:CertThumbprint"], false);
                       config.AddAzureKeyVault(
                               $"https://{builtConfig["AzureKeyVault:Vault"]}.vault.azure.net/",
                               builtConfig["AzureKeyVault:ClientId"],
                               cert.OfType<X509Certificate2>().Single());
                       store.Close();
                   })
                   .UseStartup<Startup>()
                   .Build();

在我的本地计算机上，我正确导入了证书，其中包括下载pfx格式。

但是我收到的错误消息是:

Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: 'AADSTS700027: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: 'xxx'

有什么原因导致这种情况吗？

Answer 1

该消息表明证书未使用私钥 (certmgr.msc) 导入，或者未为请求用户设置权限(使用机器存储时 - certlm.msc )