(Node.js) Easy Method to Import Certificate to Azure Key Vault

Demonstrates an easier method to import certificate with private key to an Azure key vault.

Note: This example requires Chilkat v9.5.0.96 or later.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOS

var os = require('os');
if (os.platform() == 'win32') {  
  var chilkat = require('@chilkat/ck-node23-win64'); 
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node23-linux-arm');
    } else if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node23-linux-arm64');
    } else {
        var chilkat = require('@chilkat/ck-node23-linux-x64');
    }
} else if (os.platform() == 'darwin') {
  var chilkat = require('@chilkat/ck-node23-mac-universal');
}

function chilkatExample() {

    var cert = new chilkat.Cert();

    // The certificate must originate from a source where the private key material is available to be included
    // in the upload to Azure Key Vault.

    var success = cert.LoadPfxFile("qa_data/pfx/myCert.pfx","pfx_password");
    if (success == false) {
        console.log(cert.LastErrorText);
        return;
    }

    var json = new chilkat.JsonObject();

    // Indicate this request is to upload to Azure Key Vault.
    json.UpdateString("service","azure-keyvault");

    // Provide your OAuth2 client credentials for your Azure App (service principal) that has
    // the required Role-Based Access Control (RBAC) permissions.
    json.UpdateString("auth.client_id","APP_ID");
    json.UpdateString("auth.client_secret","APP_PASSWORD");
    json.UpdateString("auth.tenant_id","TENANT_ID");

    // Indicate the key vault name
    json.UpdateString("vault_name","VAULT_NAME");

    // When you import a certificate into an Azure Key Vault, the certificate name and vault name are included as 
    // parts of the URL to specify the target location where the certificate should be stored. 
    // The URL follows a specific format to identify the target Key Vault and the certificate within it. 
    // Here's how the certificate name and vault name are incorporated into the URL:
    // https://VAULT_NAME.vault.azure.net//certificates/CERT_NAME/import?api-version=7.4

    // Specify an arbitrary certificate name, but one that can be used in a URL as shown above.  (i.e. alphanumeric with no SPACE chars)
    json.UpdateString("cert_name","CERT_NAME");

    // Add optional tags if desired. Tags can be anything you want.   
    json.UpdateString("tags.serial",cert.SerialNumber);
    json.UpdateString("tags.issuer",cert.IssuerCN);
    json.UpdateString("tags.subject",cert.SubjectCN);

    // OK.. everything is specified.  Simply call UploadToCloud.
    var jsonOut = new chilkat.JsonObject();
    jsonOut.EmitCompact = false;
    success = cert.UploadToCloud(json,jsonOut);
    if (success == false) {
        console.log(cert.LastErrorText);
        console.log(jsonOut.Emit());
        return;
    }

    // Success!  Go to the Azure portal and refresh to see the certificate has been uploaded.
    // The jsonOut provides the JSON response from the Azure server.
    console.log(jsonOut.Emit());
    console.log("Success");

    // Here is sample jsonOut

    // {
    //   "id": "https://kvchilkat.vault.azure.net/certificates/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    //   "kid": "https://kvchilkat.vault.azure.net/keys/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    //   "sid": "https://kvchilkat.vault.azure.net/secrets/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    //   "x5t": "I_e3776K5Q_6PN1HHvJoI2ZGQRQ",
    //   "cer": "MIIGXjCCBMagAw ... z50cjTsi7yIY=",
    //   "attributes": {
    //     "enabled": true,
    //     "nbf": 1633996800,
    //     "exp": 1728691199,
    //     "created": 1697754785,
    //     "updated": 1697754785,
    //     "recoveryLevel": "CustomizedRecoverable+Purgeable",
    //     "recoverableDays": 7
    //   },
    //   "tags": {
    //     "serial": "3FF5B69109BFD4046C92CC0D18EE23C2",
    //     "issuer": "Sectigo Public Code Signing CA R36",
    //     "subject": "Chilkat Software, Inc."
    //   },
    //   "policy": {
    //     "id": "https://kvchilkat.vault.azure.net/certificates/ChilkatTestCert123/policy",
    //     "key_props": {
    //       "exportable": true,
    //       "kty": "RSA",
    //       "key_size": 4096,
    //       "reuse_key": false
    //     },
    //     "secret_props": {
    //       "contentType": "application/x-pkcs12"
    //     },
    //     "x509_props": {
    //       "subject": "CN=\"Chilkat Software, Inc.\", O=\"Chilkat Software, Inc.\", S=Illinois, C=US",
    //       "ekus": [
    //         "1.3.6.1.5.5.7.3.3"
    //       ],
    //       "key_usage": [
    //         "digitalSignature"
    //       ],
    //       "validity_months": 37,
    //       "basic_constraints": {
    //         "ca": false
    //       }
    //     },
    //     "lifetime_actions": [
    //       {
    //         "trigger": {
    //           "lifetime_percentage": 80
    //         },
    //         "action": {
    //           "action_type": "EmailContacts"
    //         }
    //       }
    //     ],
    //     "issuer": {
    //       "name": "Unknown"
    //     },
    //     "attributes": {
    //       "enabled": true,
    //       "created": 1697754785,
    //       "updated": 1697754785
    //     }
    //   }
    // }

}

chilkatExample();