(Node.js) AWS KMS Import PFX Key

See more AWS KMS Examples

Imports a certificate's private key from a .pfx file to new key created in AWS KMS.

Note: This example requires Chilkat v9.5.0.96 or later.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: This example is using a relative file path.  You can also specify a full file path, such as "C:/someDir/myCertAndKey.pfx"
    // or a file path the makes sense on non-Windows operating systems..
    var cert = new chilkat.Cert();
    var success = cert.LoadPfxFile("qa_data/pfx/myCertAndKey.pfx","pfx_password");
    if (success == false) {
        console.log(cert.LastErrorText);
        return;
    }

    // Get the cert's private key.  This is what will be uploaded to AWS KMS.
    // privKey: PrivateKey
    var privKey = cert.ExportPrivateKey();
    if (cert.LastMethodSuccess == false) {
        console.log("The certificate does not have a private key.");
        return;
    }

    var json = new chilkat.JsonObject();
    json.UpdateString("service","aws-kms");
    json.UpdateString("auth.access_key","AWS_ACCESS_KEY");
    json.UpdateString("auth.secret_key","AWS_SECRET_KEY");
    json.UpdateString("auth.region","us-west-2");
    json.UpdateString("description","Test of uploading existing private key to AWS KMS");

    // Let's add some information about the certificate this key belongs to.
    // This is for informational purposes only, so that we can examine the tags
    // in the AWS KMS console and know the corresponding certificate.
    json.UpdateString("tags[0].key","CertSerial");
    json.UpdateString("tags[0].value",cert.SerialNumber);
    json.UpdateString("tags[1].key","CertIssuer");
    json.UpdateString("tags[1].value",cert.IssuerCN);
    json.UpdateString("tags[2].key","CertSubject");
    json.UpdateString("tags[2].value",cert.SubjectCN);

    json.UpdateString("keyUsage","SIGN_VERIFY");

    // The UploadToCloud method was added in Chilkat v9.5.0.96
    var jsonOut = new chilkat.JsonObject();
    success = privKey.UploadToCloud(json,jsonOut);
    if (success == false) {
        console.log(privKey.LastErrorText);

        return;
    }

    // When successful, the jsonOut contains information about the private key in AWS KMS.
    // Most importantly, the KeyId.
    jsonOut.EmitCompact = false;
    console.log(jsonOut.Emit());

    // Sample JSON result:

    // {
    //   "AWSAccountId": "954491834127",
    //   "Arn": "arn:aws:kms:us-west-2:954491834127:key/187012e8-008f-4fc7-b100-5efe6146dff2",
    //   "KeySpec": "RSA_4096",
    //   "Description": "Test of uploading existing private key to AWS KMS",
    //   "KeyId": "187012e8-008f-4fc7-b100-5efe6146dff2",
    //   "KeyUsage": "SIGN_VERIFY"
    // }

}

chilkatExample();