如何使用 powershell 从 Azure keyvault in.cer 格式下载证书？

Question

I would like to download certificate from keyvault in the format.cer as part of my automation script. How would I do it using powershell?

Answer 1

If you want to download the certificate as .cer file in the automation runbook, you could use the script below to download it to the temp folder $env:temp .

Make sure you have already added the service principal related to the RunAs Account to the Access policies of your keyvault, it needs the Get in Secret Permissions and Get in Certificate Permissions .

Sample:

$connectionName = "AzureRunAsConnection"
try
{
    # Get the connection "AzureRunAsConnection "
    $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName         

    Connect-AzAccount `
        -ServicePrincipal `
        -TenantId $servicePrincipalConnection.TenantId `
        -ApplicationId $servicePrincipalConnection.ApplicationId `
        -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint 
}
catch {
    if (!$servicePrincipalConnection)
    {
        $ErrorMessage = "Connection $connectionName not found."
        throw $ErrorMessage
    } else{
        Write-Error -Message $_.Exception
        throw $_.Exception
    }
}

$cert = Get-AzKeyVaultCertificate -VaultName "joykeyvault" -Name "test1234"
$secret = Get-AzKeyVaultSecret -VaultName "joykeyvault" -Name $cert.Name

$secretByte = [Convert]::FromBase64String($secret.SecretValueText)
$x509Cert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2
$x509Cert.Import($secretByte, "", "Exportable,PersistKeySet")

$cer = Export-Certificate -Cert $x509Cert -FilePath $env:temp\test.cer
Write-Output $cer