CODEWITHSUNDEEP
azure-keyvault
Rick Neeft
Rick Neeft

Reputation: 145

How to prevent Private Key export for imported Certificate

Short Question: How to make an imported certificate (pfx) non-exportable?

We have a certificate (pfx) file that we would like to import into Azure KeyVault. However we are unable make this certificate non-exportable. There is an option, under Issuance Policy/Advanced Policy Configuration, in which you can set 'Exportable Private Key' to 'No' but is seems not to apply for imported certificates.

The code that we use is:

        var keyVaultClient = CreateKeyVaultClient();
        var name = "non-exportable-cert";

        var secret = await keyVaultClient.GetSecretAsync("azure-key-vault-url", name);

        var cert = new X509Certificate2(Convert.FromBase64String(secret.Value));

         // cert.HasPrivateKey = always True.

When using the Windows Certificate store we have to explicit mark the certificate as exportable. We do not have this option at all in the Azure Key Vault.

When we generate a certificate in the Key Vault this option does work, which result in the cert.HasPrivateKey set to False.

Is this scenario not supported or are we missing something? Thanks in advance!

Upvotes: 1

Views: 1592

Answers (1)

Joey Cai
Joey Cai

Reputation: 20097

When you import certificate to Azure Key vault, you could set the exportable to false in KeyProperties which indicates the private key can not be exported.

For more details, you could refer to this article.

Upvotes: -1

Related Questions