azure - 如何使用 ARM 在自动化帐户中推送带有密码的 pfx 证书

Question

我想使用 ARM 在自动化帐户中推送带有密码的 pfx 证书

{
    "type": "certificates",
    "apiVersion": "2015-10-31",
    "name": "AzureRunAsCertificate",
    "location": "[resourceGroup().location]",
    "dependsOn": ["[concat('Microsoft.Automation/automationAccounts/', parameters('accountName'))]"],
    "properties": {
        "base64Value": "MIII4QIBAzCCCKcGCSqGSIb3..........kdHQQIXbFXVHGs6qACAggA",
        "isExportable": true,
        "thumbprint": "5FF426ABD6D26E592783944A9A3FF5EF80A9045C"
     }
},

当我尝试时，我遇到了错误的请求错误

Microsoft.Automation/automationAccounts/certificates InternalServerError Operation details

您对指定密码的语法有任何了解吗？

Answer 1

这是文档中的示例:

$AutomationAccountName = "<automation account name>"
$PfxCertPath = '<PFX cert path'
$CertificatePassword = '<password>'
$certificateName = '<certificate name>'
$AutomationAccountName = '<automation account name>'
$flags = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable `
    -bor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet `
    -bor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::MachineKeySet
# Load the certificate into memory
$PfxCert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @($PfxCertPath, $CertificatePassword, $flags)
# Export the certificate and convert into base 64 string
$Base64Value = [System.Convert]::ToBase64String($PfxCert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12))
$Thumbprint = $PfxCert.Thumbprint


$json = @"
{
    '`$schema': 'https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#',
    'contentVersion': '1.0.0.0',
    'resources': [
        {
            'name': '$AutomationAccountName/$certificateName',
            'type': 'Microsoft.Automation/automationAccounts/certificates',
            'apiVersion': '2015-10-31',
            'properties': {
                'base64Value': '$Base64Value',
                'thumbprint': '$Thumbprint',
                'isExportable': true
            }
        }
    ]
}
"@

$json | out-file .\template.json
New-AzureRmResourceGroupDeployment -Name NewCert -ResourceGroupName TestAzureAuto -TemplateFile .\template.json

基本上，您需要使用 System.Security.Cryptography 使用密码导出它:

# Load the certificate into memory
$PfxCert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @($PfxCertPath, $CertificatePassword, $flags)
# Export the certificate and convert into base 64 string
$Base64Value = [System.Convert]::ToBase64String($PfxCert.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12))

然后您可以将其传递给模板 base64Value 属性

https://learn.microsoft.com/en-us/azure/automation/shared-resources/certificates#creating-a-new-certificate