c# - 从 Azure Keyvault c# 获取带私钥的 X509 证书

Question

我目前正在使用 C# 开发的身份验证服务器，该服务器托管在 azure 函数应用程序上，我使用存储我的 secret 的 KeyVault。我的问题如下，在我的 keystore 中，我存储了一个证书(证书+私钥)当我在我的代码中检索它时，但未返回私钥。如果我测试以下方法:HasPrivateKey 代码返回 false ...但如果我在本地使用相同的 .pfx，代码会返回 true ...我的代码:

 var client = new CertificateClient(vaultUri: new Uri("https://diiage2p1g3chest.vault.azure.net/"),credential: new DefaultAzureCredential());
         KeyVaultCertificate kcertificate = client.GetCertificate("try");
         var cert_content = kcertificate.Cer;
       X509Certificate2  certificate = new X509Certificate2(cert_content, "password", X509KeyStorageFlags.EphemeralKeySet);

知道问题出在哪里吗？

Answer 1

CertificateClient 有一个返回带有私钥的证书的方法，但它的作用并不明显。

来自 CertificateClient.DownloadCertificate :

Because Cer contains only the public key, this method attempts to download the managed secret that contains the full certificate. If you do not have permissions to get the secret, RequestFailedException will be thrown with an appropriate error response. If you want an X509Certificate2 with only the public key, instantiate it passing only the Cer property. This operation requires the certificates/get and secrets/get permissions.

因此，只需重构您的代码以使用 DownloadCertificate 获取带有私钥的证书。

var client = new CertificateClient(new Uri("https://diiage2p1g3chest.vault.azure.net/"),  new DefaultAzureCredential()); 
X509Certificate2 certificate = client.DownloadCertificate("try");