azure - 如何从 keystore 检索证书并将其导入到另一个 keystore 而不保存它？

Question

在 Azure 管道中有以下任务

1. AzureResourceManagerTemplateDeployment@3 从 ARM 模板部署 Key Vault
2. 然后，AzurePowerShell@5 检查 key 保管库是否包含“my-self-signed-cert”，如果不包含，则将其导入 key 保管库
3. 最后，另一个 AzureResourceManagerTemplateDeployment@3 部署 Service Fabric 群集并配置 SF 群集及其 VMSS 以使用证书

以下是任务:

- task: AzureResourceManagerTemplateDeployment@3
  displayName: 'Deploy Keyvault'
  inputs:
    deploymentScope: 'Resource Group'
    subscriptionId: '${{ parameters.SubscriptionId }}'
    azureResourceManagerConnection: '${{ parameters.ArmConnection }}'
    action: 'Create Or Update Resource Group'
    resourceGroupName: '${{ parameters.resourceGroupName }}'
    location: 'West Europe'
    templateLocation: 'Linked artifact'
    csmFile: '$(Build.SourcesDirectory)/pipelines/templates/keyvault.json'
    csmParametersFile: '$(Build.SourcesDirectory)/pipelines/templates/keyvault-params.json'
    deploymentMode: 'Incremental'

- task: ARM Outputs@5
  displayName: 'Collect Keyvault output'
  inputs:
    ConnectedServiceNameSelector: 'ConnectedServiceNameARM'
    ConnectedServiceNameARM: '${{ parameters.ArmConnection }}'
    resourceGroupName: '${{ parameters.resourceGroupName }}'
    whenLastDeploymentIsFailed: 'fail'

- task: AzurePowerShell@5
  displayName: 'Import certificate'
  inputs:
    azureSubscription: '${{ parameters.ArmConnection }}'
    ScriptType: 'InlineScript'
    azurePowerShellVersion: '3.1.0'
    Inline: |
      $Cert = Get-AzKeyVaultCertificate -VaultName my-kv -Name my-self-signed-cert
      if (!$Cert) {
          $Base64 = 'MIIWMgIBA___3000_chars_here____o7WqDoWm5I7fg=='
          $Cert = Import-AzKeyVaultCertificate -VaultName my-kv -Name my-self-signed-cert -CertificateString $Base64
      }
      # set the pipeline variables Thumbprint and SecretId - needed for SF deployment
      echo "##vso[task.setvariable variable=Thumbprint]$($Cert.Thumbprint)"
      echo "##vso[task.setvariable variable=SecretId]$($Cert.SecretId)"

# deploy SF cluster by ARM template and use the SF Cluster certificate thumbsprint as admin cert
- task: AzureResourceManagerTemplateDeployment@3
  displayName: 'Deploy SF cluster'
  inputs:
    deploymentScope: 'Resource Group'
    subscriptionId: '${{ parameters.SubscriptionId }}'
    azureResourceManagerConnection: '${{ parameters.ArmConnection }}'
    action: 'Create Or Update Resource Group'
    resourceGroupName: '${{ parameters.resourceGroupName }}'
    location: 'West Europe'
    templateLocation: 'Linked artifact'
    csmFile: '$(Build.SourcesDirectory)/pipelines/templates/sfcluster.json'
    csmParametersFile: '$(Build.SourcesDirectory)/pipelines/templates/sfcluster-params.json'
    overrideParameters: '-certificateThumbprint $(Thumbprint) -sourceVaultResourceId $(KeyvaultId) -certificateUrlValue $(SecretId)'
    deploymentMode: 'Incremental'

这效果很好，但现在我尝试用托管在另一个 Key Vault 上的真实证书替换自签名证书。

我的计划是从其他 Key Vault 下载新的证书内容(包括 key )，然后对其进行 Base64 编码(以避免创建任何临时文件) - 最后 Import-AzKeyVaultCertificate ... -CertificateString $Base64 存入我的 Key Vault(请参阅我的任务列表中的“步骤 2”)。

我的问题是我无法检索证书内容。

我可以使用以下 PowerShell 命令检索“真实”证书:

$Cert = Get-AzKeyVaultCertificate -VaultName the-company-kv -Name the-real-cert
$Secret = Get-AzKeyVaultSecret -VaultName the-company-kv -Name the-real-cert

上面的命令返回一些元数据，但没有任何类似于我能够得到的内容(如果尚未进行 Base64 编码):

$Base64 = [System.Convert]::ToBase64String($Bytes)
Import-AzKeyVaultCertificate -VaultName my-kv -Name my-self-signed-cert -CertificateString $Base64

Answer 1

以下是如何将证书从一个 Key Vault 复制到另一个 Key Vault(此处:the-company-kv -> my-kv)而不将其保存到临时文件中的解决方案:

$Cert = Get-AzKeyVaultCertificate -VaultName my-kv -Name the-real-cert
if (!$Cert) {
    $OrigCert = Get-AzKeyVaultCertificate -VaultName the-company-kv -Name the-real-cert
    $Secret = Get-AzKeyVaultSecret -VaultName the-company-kv -Name $OrigCert.Name
    $Cert = Import-AzKeyVaultCertificate -VaultName my-kv -Name $OrigCert.Name -CertificateString $Secret.SecretValueText
}

当我在命令提示符下输入 $Secret 时，我没有意识到 PowerShell 并未显示所有属性，因此我没有看到 $Secret.SecretValueText 首先。