public async Task HelloWorldAsync()
{
// Environment variable with the Key Vault endpoint.
string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL");
// Instantiate a certificate client that will be used to call the service. Notice that the client is using
// default Azure credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID',
// 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials.
var client = new CertificateClient(new Uri(keyVaultUrl), new DefaultAzureCredential());
// Let's create a self signed certifiate using the default policy. If the certificiate
// already exists in the Key Vault, then a new version of the key is created.
string certName = $"defaultCert-{Guid.NewGuid()}";
CertificateOperation certOp = await client.StartCreateCertificateAsync(certName);
// Next let's wait on the certificate operation to complete. Note that certificate creation can last an indeterministic
// amount of time, so applications should only wait on the operation to complete in the case the issuance time is well
// known and within the scope of the application lifetime. In this case we are creating a self-signed certificate which
// should be issued in a relatively short amount of time.
CertificateWithPolicy certificate = await certOp.WaitCompletionAsync();
// At some time later we could get the created certificate along with it's policy from the Key Vault.
certificate = await client.GetCertificateWithPolicyAsync(certName);
Debug.WriteLine($"Certificate was returned with name {certificate.Name} which expires {certificate.Properties.Expires}");
// We find that the certificate has been compromised and we want to disable it so applications will no longer be able
// to access the compromised version of the certificate.
CertificateProperties certificateProperties = certificate.Properties;
certificateProperties.Enabled = false;
Certificate updatedCert = await client.UpdateCertificatePropertiesAsync(certificateProperties);
Debug.WriteLine($"Certificate enabled set to '{updatedCert.Properties.Enabled}'");
// We need to create a new version of the certificate that applications can use to replace the compromised certificate.
// Creating a certificate with the same name and policy as the compromised certificate will create another version of the
// certificate with similar properties to the original certificate
CertificateOperation newCertOp = await client.StartCreateCertificateAsync(certificate.Name, certificate.Policy);
CertificateWithPolicy newCert = await newCertOp.WaitCompletionAsync();
// The certificate is no longer needed, need to delete it from the Key Vault.
await client.DeleteCertificateAsync(certName);
// To ensure key is deleted on server side.
Assert.IsTrue(await WaitForDeletedKeyAsync(client, certName));
// If the keyvault is soft-delete enabled, then for permanent deletion, deleted key needs to be purged.
await client.PurgeDeletedCertificateAsync(certName);
}
protected async Task <CertificateWithPolicy> WaitForCompletion(CertificateOperation operation)
{
operation.PollingInterval = TimeSpan.FromSeconds((Mode == RecordedTestMode.Playback) ? 0 : 1);
if (IsAsync)
{
await operation.WaitCompletionAsync();
}
else
{
while (!operation.HasValue)
{
operation.UpdateStatus();
await Task.Delay(operation.PollingInterval);
}
}
return(operation.Value);
}
public async Task CreateClientAsync()
{
// Environment variable with the Key Vault endpoint.
string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL");
#region CreateClient
// Create a new certificate client using the default credential from Azure.Identity using environment variables previously set,
// including AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID.
var client = new CertificateClient(vaultUri: new Uri(keyVaultUrl), credential: new DefaultAzureCredential());
#endregion
#region CreateCertificate
// Create a certificate. This starts a long running operation to create and sign the certificate.
CertificateOperation operation = await client.StartCreateCertificateAsync("MyCertificate");
// You can await the completion of the create certificate operation.
CertificateWithPolicy certificate = await operation.WaitCompletionAsync();
#endregion
this.client = client;
}
public async Task GetCertificatesAsync()
{
// Environment variable with the Key Vault endpoint.
string keyVaultUrl = Environment.GetEnvironmentVariable("AZURE_KEYVAULT_URL");
// Instantiate a certificate client that will be used to call the service. Notice that the client is using default Azure
// credentials. To make default credentials work, ensure that environment variables 'AZURE_CLIENT_ID',
// 'AZURE_CLIENT_KEY' and 'AZURE_TENANT_ID' are set with the service principal credentials.
var client = new CertificateClient(new Uri(keyVaultUrl), new DefaultAzureCredential());
// Let's create two self-signed certificates using the default policy
string certName1 = $"defaultCert-{Guid.NewGuid()}";
CertificateOperation certOp1 = await client.StartCreateCertificateAsync(certName1);
string certName2 = $"defaultCert-{Guid.NewGuid()}";
CertificateOperation certOp2 = await client.StartCreateCertificateAsync(certName1);
// Next let's wait on the certificate operation to complete. Note that certificate creation can last an indeterministic
// amount of time, so applications should only wait on the operation to complete in the case the issuance time is well
// known and within the scope of the application lifetime. In this case we are creating a self-signed certificate which
// should be issued in a relatively short amount of time.
await certOp1.WaitCompletionAsync();
await certOp2.WaitCompletionAsync();
// Let's list the certificates which exist in the vault along with their thumbprints
await foreach (CertificateBase cert in client.GetCertificatesAsync())
{
Debug.WriteLine($"Certificate is returned with name {cert.Name} and thumbprint {BitConverter.ToString(cert.X509Thumbprint)}");
}
// We need to create a new version of a certificate. Creating a certificate with the same name will create another version of the certificate
CertificateOperation newCertOp = await client.StartCreateCertificateAsync(certName1);
await newCertOp.WaitCompletionAsync();
// Let's print all the versions of this certificate
await foreach (CertificateBase cert in client.GetCertificateVersionsAsync(certName1))
{
Debug.WriteLine($"Certificate {cert.Name} with name {cert.Version}");
}
// The certificates are no longer needed.
// You need to delete them from the Key Vault.
await client.DeleteCertificateAsync(certName1);
await client.DeleteCertificateAsync(certName2);
// To ensure certificates are deleted on server side.
Assert.IsTrue(await WaitForDeletedCertificateAsync(client, certName1));
Assert.IsTrue(await WaitForDeletedCertificateAsync(client, certName2));
// You can list all the deleted and non-purged certificates, assuming Key Vault is soft-delete enabled.
await foreach (DeletedCertificate deletedCert in client.GetDeletedCertificatesAsync())
{
Debug.WriteLine($"Deleted certificate's recovery Id {deletedCert.RecoveryId}");
}
// If the keyvault is soft-delete enabled, then for permanent deletion, deleted keys needs to be purged.
await client.PurgeDeletedCertificateAsync(certName1);
await client.PurgeDeletedCertificateAsync(certName2);
}