DataFlex

Easy Method to Import Certificate to Azure Key Vault

See more Azure Key Vault Examples

Demonstrates an easier method to import certificate with private key to an Azure key vault.

Note: This example requires Chilkat v9.5.0.96 or later.

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoCert
    Variant vJson
    Handle hoJson
    Variant vJsonOut
    Handle hoJsonOut
    String sTemp1

    Move False To iSuccess

    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End

    // The certificate must originate from a source where the private key material is available to be included
    // in the upload to Azure Key Vault.

    Get ComLoadPfxFile Of hoCert "qa_data/pfx/myCert.pfx" "pfx_password" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get Create (RefClass(cComChilkatJsonObject)) To hoJson
    If (Not(IsComObjectCreated(hoJson))) Begin
        Send CreateComObject of hoJson
    End

    // Indicate this request is to upload to Azure Key Vault.
    Get ComUpdateString Of hoJson "service" "azure-keyvault" To iSuccess

    // Provide your OAuth2 client credentials for your Azure App (service principal) that has
    // the required Role-Based Access Control (RBAC) permissions.
    Get ComUpdateString Of hoJson "auth.client_id" "APP_ID" To iSuccess
    Get ComUpdateString Of hoJson "auth.client_secret" "APP_PASSWORD" To iSuccess
    Get ComUpdateString Of hoJson "auth.tenant_id" "TENANT_ID" To iSuccess

    // Indicate the key vault name
    Get ComUpdateString Of hoJson "vault_name" "VAULT_NAME" To iSuccess

    // When you import a certificate into an Azure Key Vault, the certificate name and vault name are included as 
    // parts of the URL to specify the target location where the certificate should be stored. 
    // The URL follows a specific format to identify the target Key Vault and the certificate within it. 
    // Here's how the certificate name and vault name are incorporated into the URL:
    // https://VAULT_NAME.vault.azure.net//certificates/CERT_NAME/import?api-version=7.4

    // Specify an arbitrary certificate name, but one that can be used in a URL as shown above.  (i.e. alphanumeric with no SPACE chars)
    Get ComUpdateString Of hoJson "cert_name" "CERT_NAME" To iSuccess

    // Add optional tags if desired. Tags can be anything you want.   
    Get ComSerialNumber Of hoCert To sTemp1
    Get ComUpdateString Of hoJson "tags.serial" sTemp1 To iSuccess
    Get ComIssuerCN Of hoCert To sTemp1
    Get ComUpdateString Of hoJson "tags.issuer" sTemp1 To iSuccess
    Get ComSubjectCN Of hoCert To sTemp1
    Get ComUpdateString Of hoJson "tags.subject" sTemp1 To iSuccess

    // OK.. everything is specified.  Simply call UploadToCloud.
    Get Create (RefClass(cComChilkatJsonObject)) To hoJsonOut
    If (Not(IsComObjectCreated(hoJsonOut))) Begin
        Send CreateComObject of hoJsonOut
    End
    Set ComEmitCompact Of hoJsonOut To False
    Get pvComObject of hoJson to vJson
    Get pvComObject of hoJsonOut to vJsonOut
    Get ComUploadToCloud Of hoCert vJson vJsonOut To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoCert To sTemp1
        Showln sTemp1
        Get ComEmit Of hoJsonOut To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Success!  Go to the Azure portal and refresh to see the certificate has been uploaded.
    // The jsonOut provides the JSON response from the Azure server.
    Get ComEmit Of hoJsonOut To sTemp1
    Showln sTemp1
    Showln "Success"

    // Here is sample jsonOut

    // {
    //   "id": "https://kvchilkat.vault.azure.net/certificates/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    //   "kid": "https://kvchilkat.vault.azure.net/keys/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    //   "sid": "https://kvchilkat.vault.azure.net/secrets/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    //   "x5t": "I_e3776K5Q_6PN1HHvJoI2ZGQRQ",
    //   "cer": "MIIGXjCCBMagAw ... z50cjTsi7yIY=",
    //   "attributes": {
    //     "enabled": true,
    //     "nbf": 1633996800,
    //     "exp": 1728691199,
    //     "created": 1697754785,
    //     "updated": 1697754785,
    //     "recoveryLevel": "CustomizedRecoverable+Purgeable",
    //     "recoverableDays": 7
    //   },
    //   "tags": {
    //     "serial": "3FF5B69109BFD4046C92CC0D18EE23C2",
    //     "issuer": "Sectigo Public Code Signing CA R36",
    //     "subject": "Chilkat Software, Inc."
    //   },
    //   "policy": {
    //     "id": "https://kvchilkat.vault.azure.net/certificates/ChilkatTestCert123/policy",
    //     "key_props": {
    //       "exportable": true,
    //       "kty": "RSA",
    //       "key_size": 4096,
    //       "reuse_key": false
    //     },
    //     "secret_props": {
    //       "contentType": "application/x-pkcs12"
    //     },
    //     "x509_props": {
    //       "subject": "CN=\"Chilkat Software, Inc.\", O=\"Chilkat Software, Inc.\", S=Illinois, C=US",
    //       "ekus": [
    //         "1.3.6.1.5.5.7.3.3"
    //       ],
    //       "key_usage": [
    //         "digitalSignature"
    //       ],
    //       "validity_months": 37,
    //       "basic_constraints": {
    //         "ca": false
    //       }
    //     },
    //     "lifetime_actions": [
    //       {
    //         "trigger": {
    //           "lifetime_percentage": 80
    //         },
    //         "action": {
    //           "action_type": "EmailContacts"
    //         }
    //       }
    //     ],
    //     "issuer": {
    //       "name": "Unknown"
    //     },
    //     "attributes": {
    //       "enabled": true,
    //       "created": 1697754785,
    //       "updated": 1697754785
    //     }
    //   }
    // }


End_Procedure