(CkPython) AWS KMS Import PFX Key

See more AWS KMS Examples

Imports a certificate's private key from a .pfx file to new key created in AWS KMS.

Note: This example requires Chilkat v9.5.0.96 or later.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# Note: This example is using a relative file path.  You can also specify a full file path, such as "C:/someDir/myCertAndKey.pfx"
# or a file path the makes sense on non-Windows operating systems..
cert = chilkat.CkCert()
success = cert.LoadPfxFile("qa_data/pfx/myCertAndKey.pfx","pfx_password")
if (success == False):
    print(cert.lastErrorText())
    sys.exit()

# Get the cert's private key.  This is what will be uploaded to AWS KMS.
# privKey is a CkPrivateKey
privKey = cert.ExportPrivateKey()
if (cert.get_LastMethodSuccess() == False):
    print("The certificate does not have a private key.")
    sys.exit()

json = chilkat.CkJsonObject()
json.UpdateString("service","aws-kms")
json.UpdateString("auth.access_key","AWS_ACCESS_KEY")
json.UpdateString("auth.secret_key","AWS_SECRET_KEY")
json.UpdateString("auth.region","us-west-2")
json.UpdateString("description","Test of uploading existing private key to AWS KMS")

# Let's add some information about the certificate this key belongs to.
# This is for informational purposes only, so that we can examine the tags
# in the AWS KMS console and know the corresponding certificate.
json.UpdateString("tags[0].key","CertSerial")
json.UpdateString("tags[0].value",cert.serialNumber())
json.UpdateString("tags[1].key","CertIssuer")
json.UpdateString("tags[1].value",cert.issuerCN())
json.UpdateString("tags[2].key","CertSubject")
json.UpdateString("tags[2].value",cert.subjectCN())

json.UpdateString("keyUsage","SIGN_VERIFY")

# The UploadToCloud method was added in Chilkat v9.5.0.96
jsonOut = chilkat.CkJsonObject()
success = privKey.UploadToCloud(json,jsonOut)
if (success == False):
    print(privKey.lastErrorText())

    sys.exit()

# When successful, the jsonOut contains information about the private key in AWS KMS.
# Most importantly, the KeyId.
jsonOut.put_EmitCompact(False)
print(jsonOut.emit())

# Sample JSON result:

# {
#   "AWSAccountId": "954491834127",
#   "Arn": "arn:aws:kms:us-west-2:954491834127:key/187012e8-008f-4fc7-b100-5efe6146dff2",
#   "KeySpec": "RSA_4096",
#   "Description": "Test of uploading existing private key to AWS KMS",
#   "KeyId": "187012e8-008f-4fc7-b100-5efe6146dff2",
#   "KeyUsage": "SIGN_VERIFY"
# }