azure - 在 powershell 中从 keyvault 导入 X509Certificate2 证书时出错

Question

我正在尝试将证书从 azure key Vault 导入到 powershell 中的 X509Certificate2 中，但遇到了几个阻止程序。所以我从以下开始:

$secret = Get-AzKeyVaultSecret -VaultName "<vaultName>" -Name "<certName>"
$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secret.SecretValue)
try {
     $secretValueText = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)
} finally {
     [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)
}
$secretByte = [Convert]::FromBase64String($secretValueText)

我在最后一行收到一个错误，提示“输入不是有效的 Base-64 字符串，因为它包含非 Base 64 字符”

查看 $secretValueText 中的文本，我看到数据格式如下:

    -----BEGIN PRIVATE KEY-----  
WWWWWW...
    -----END PRIVATE KEY-----
    -----BEGIN CERTIFICATE-----  
XXXXXX....
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----  
YYYYY.....
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----  
ZZZZZZZ.....
    -----END CERTIFICATE-----

如何转换该文本以便我可以运行

$authcert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$authcert.Import($secretByte, "", "Exportable,PersistKeySet")

我也尝试过:

$secretPlain = ConvertFrom-SecureString $secret.SecretValue

这实际上允许转换工作，但在“$authcert.import”上我收到错误“调用导入时出现异常，找不到请求的对象”

Answer 1

执行命令ConvertFrom-SecureString时需要指定-AsPlainText参数:

$secretValueText = ConvertFrom-SecureString $secret.SecretValue -AsPlainText

完整示例:

$keyVaultName = "<vaultName>"
$certName = "<certName>"

$secret = Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $certName
$secretValueText = ConvertFrom-SecureString $secret.SecretValue -AsPlainText
$secretByte = [Convert]::FromBase64String($secretValueText)

$authcert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 `
  ($secretByte, "", "Exportable,PersistKeySet")

您还可以在执行命令 Get-AzKeyVaultSecret 时使用 -AsPlainText 参数检索 secret 值:

$keyVaultName = "<vaultName>"
$certName = "<certName>"

$secretValueText = Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $certName -AsPlainText
$secretByte = [Convert]::FromBase64String($secretValueText)

$authcert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 `
  ($secretByte, "", "Exportable,PersistKeySet")