Azure：在應用服務中使用從 Key Vault 獲得的證書時出錯

Question

在運行 net472 web 應用程序的 Azure 應用程序服務中，我從密鑰庫訪問證書，如下所示：

var certSecret = await kvClient.GetSecretAsync(kvName, secretName);

然后我需要發送證書以向外部服務進行身份驗證

var cert = new X509Certificate2(Convert.FromBase64String(certSecret.Value));

此行會引發錯誤

System.Security.Cryptography.CryptographicException: The system cannot find the file specified.

   at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)
   at System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle& pCertCtx)
   at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData)
   at System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData)

Answer 1

嘗試獲取如下秘密：

var certSecret = await kvClient.GetSecretAsync(vaultBaseUrl, secretName);

您可以檢索certSecret.value以檢查它是否具有值，然后將其發送到指定X509KeyStorageFlags存儲標志的X509Certificate2 。

X509Certificate2 x509 = new X509Certificate2(Convert.FromBase64String(certSecret.value), string.Empty, X509KeyStorageFlags.MachineKeySet)