node.js - 从 Node.js 中的 Azure keyvault 获取正确的 pfx 文件

Question

我正在尝试从 azure keyvault 获取 pfx 文件，而不是将其放置在本地计算机上。我打算用它来创建一个 HTTPS 服务器。

但是，当我从 keyvault 读取它并写入本地的 pfx 文件时。该文件的大小似乎略有变化，即使使用正确的密码也无法再生成证书。我在 java 上尝试了同样的方法，但似乎不特定于平台。

    client.getSecret("https://sl-dev-keys.vault.azure.net/secrets/newcertpfx/888175c395264e6096bf0a02ef73de1a", function(getErr, getSecretBundle) {    
    if (getErr) throw getErr;
    console.log('\n\nSecret ', getSecretBundle.value, ' is retrieved.\n');

    var fs = require('fs');
    var fileContent = getSecretBundle.value;

    let writeStream = fs.createWriteStream('test.pfx');

    // write some data with a base64 encoding
    writeStream.write(fileContent, 'base64');

    // the finish event is emitted when all data has been flushed from the stream
    writeStream.on('finish', () => {  
        console.log('wrote all data to file');
    });

    // close the stream
    writeStream.end('end');

Answer 1

以下是如何使用从 Azure keyvault 获取的证书作为 sercret 来设置 node.js https 服务器的示例。

import { SecretClient } from '@azure/keyvault-secrets';
import https from 'https';

...

const client = new SecretClient(url, credential);
const secret = await client.getSecret(certificateName);

const options = {
  pfx: new Buffer(secret.value, 'base64')
};

https.createServer(options, app).listen(PORT);