(PureBasic) Easy Method to Import Certificate to Azure Key Vault

Demonstrates an easier method to import certificate with private key to an Azure key vault.

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat PureBasic Module Download Chilkat PureBasic Module

IncludeFile "CkJsonObject.pb"
IncludeFile "CkCert.pb"

Procedure ChilkatExample()

    cert.i = CkCert::ckCreate()
    If cert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; The certificate must originate from a source where the private key material is available to be included
    ; in the upload to Azure Key Vault.

    success.i = CkCert::ckLoadPfxFile(cert,"qa_data/pfx/myCert.pfx","pfx_password")
    If success = 0
        Debug CkCert::ckLastErrorText(cert)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    json.i = CkJsonObject::ckCreate()
    If json.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Indicate this request is to upload to Azure Key Vault.
    CkJsonObject::ckUpdateString(json,"service","azure-keyvault")

    ; Provide your OAuth2 client credentials for your Azure App (service principal) that has
    ; the required Role-Based Access Control (RBAC) permissions.
    CkJsonObject::ckUpdateString(json,"auth.client_id","APP_ID")
    CkJsonObject::ckUpdateString(json,"auth.client_secret","APP_PASSWORD")
    CkJsonObject::ckUpdateString(json,"auth.tenant_id","TENANT_ID")

    ; Indicate the key vault name
    CkJsonObject::ckUpdateString(json,"vault_name","VAULT_NAME")

    ; When you import a certificate into an Azure Key Vault, the certificate name and vault name are included as 
    ; parts of the URL to specify the target location where the certificate should be stored. 
    ; The URL follows a specific format to identify the target Key Vault and the certificate within it. 
    ; Here's how the certificate name and vault name are incorporated into the URL:
    ; https://VAULT_NAME.vault.azure.net//certificates/CERT_NAME/import?api-version=7.4

    ; Specify an arbitrary certificate name, but one that can be used in a URL as shown above.  (i.e. alphanumeric with no SPACE chars)
    CkJsonObject::ckUpdateString(json,"cert_name","CERT_NAME")

    ; Add optional tags if desired. Tags can be anything you want.   
    CkJsonObject::ckUpdateString(json,"tags.serial",CkCert::ckSerialNumber(cert))
    CkJsonObject::ckUpdateString(json,"tags.issuer",CkCert::ckIssuerCN(cert))
    CkJsonObject::ckUpdateString(json,"tags.subject",CkCert::ckSubjectCN(cert))

    ; OK.. everything is specified.  Simply call UploadToCloud.
    jsonOut.i = CkJsonObject::ckCreate()
    If jsonOut.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::setCkEmitCompact(jsonOut, 0)
    success = CkCert::ckUploadToCloud(cert,json,jsonOut)
    If success = 0
        Debug CkCert::ckLastErrorText(cert)
        Debug CkJsonObject::ckEmit(jsonOut)
        CkCert::ckDispose(cert)
        CkJsonObject::ckDispose(json)
        CkJsonObject::ckDispose(jsonOut)
        ProcedureReturn
    EndIf

    ; Success!  Go to the Azure portal and refresh to see the certificate has been uploaded.
    ; The jsonOut provides the JSON response from the Azure server.
    Debug CkJsonObject::ckEmit(jsonOut)
    Debug "Success"

    ; Here is sample jsonOut

    ; {
    ;   "id": "https://kvchilkat.vault.azure.net/certificates/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    ;   "kid": "https://kvchilkat.vault.azure.net/keys/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    ;   "sid": "https://kvchilkat.vault.azure.net/secrets/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
    ;   "x5t": "I_e3776K5Q_6PN1HHvJoI2ZGQRQ",
    ;   "cer": "MIIGXjCCBMagAw ... z50cjTsi7yIY=",
    ;   "attributes": {
    ;     "enabled": true,
    ;     "nbf": 1633996800,
    ;     "exp": 1728691199,
    ;     "created": 1697754785,
    ;     "updated": 1697754785,
    ;     "recoveryLevel": "CustomizedRecoverable+Purgeable",
    ;     "recoverableDays": 7
    ;   },
    ;   "tags": {
    ;     "serial": "3FF5B69109BFD4046C92CC0D18EE23C2",
    ;     "issuer": "Sectigo Public Code Signing CA R36",
    ;     "subject": "Chilkat Software, Inc."
    ;   },
    ;   "policy": {
    ;     "id": "https://kvchilkat.vault.azure.net/certificates/ChilkatTestCert123/policy",
    ;     "key_props": {
    ;       "exportable": true,
    ;       "kty": "RSA",
    ;       "key_size": 4096,
    ;       "reuse_key": false
    ;     },
    ;     "secret_props": {
    ;       "contentType": "application/x-pkcs12"
    ;     },
    ;     "x509_props": {
    ;       "subject": "CN=\"Chilkat Software, Inc.\", O=\"Chilkat Software, Inc.\", S=Illinois, C=US",
    ;       "ekus": [
    ;         "1.3.6.1.5.5.7.3.3"
    ;       ],
    ;       "key_usage": [
    ;         "digitalSignature"
    ;       ],
    ;       "validity_months": 37,
    ;       "basic_constraints": {
    ;         "ca": false
    ;       }
    ;     },
    ;     "lifetime_actions": [
    ;       {
    ;         "trigger": {
    ;           "lifetime_percentage": 80
    ;         },
    ;         "action": {
    ;           "action_type": "EmailContacts"
    ;         }
    ;       }
    ;     ],
    ;     "issuer": {
    ;       "name": "Unknown"
    ;     },
    ;     "attributes": {
    ;       "enabled": true,
    ;       "created": 1697754785,
    ;       "updated": 1697754785
    ;     }
    ;   }
    ; }


    CkCert::ckDispose(cert)
    CkJsonObject::ckDispose(json)
    CkJsonObject::ckDispose(jsonOut)


    ProcedureReturn
EndProcedure