Schnellstart: Azure Key Vault-Zertifikatclientbibliothek für JavaScript

Voraussetzungen

• Azure-Abonnement (kostenloses Abonnement erstellen)
• Aktuell Node.js LTS.
• Azure-Befehlszeilenschnittstelle
• Ein vorhandener Schlüsseltresor – Sie können einen mit den von Ihnen erstellten Schlüsseltresor erstellen:
  • Azure-Befehlszeilenschnittstelle
  • Azure portal
  • Azure PowerShell

• Azure-Abonnement (kostenloses Abonnement erstellen)
• Aktuell Node.js LTS.
• TypeScript 5+
• Azure-Befehlszeilenschnittstelle
• Ein vorhandener Schlüsseltresor – Sie können einen mit den von Ihnen erstellten Schlüsseltresor erstellen:
  • Azure-Befehlszeilenschnittstelle
  • Azure portal
  • Azure PowerShell

• Erstellen Sie eine neue Textdatei und fügen Sie den folgenden Code in die Datei index.js ein.

  const { CertificateClient, DefaultCertificatePolicy } = require("@azure/keyvault-certificates");
  const { DefaultAzureCredential } = require("@azure/identity");
  
  async function main() {
    // If you're using MSI, DefaultAzureCredential should "just work".
    // Otherwise, DefaultAzureCredential expects the following three environment variables:
    // - AZURE_TENANT_ID: The tenant ID in Azure Active Directory
    // - AZURE_CLIENT_ID: The application (client) ID registered in the AAD tenant
    // - AZURE_CLIENT_SECRET: The client secret for the registered application
    const credential = new DefaultAzureCredential();
  
    const keyVaultUrl = process.env["KEY_VAULT_URL"];
    if(!keyVaultUrl) throw new Error("KEY_VAULT_URL is empty");
  
    const client = new CertificateClient(keyVaultUrl, credential);
  
    const uniqueString = new Date().getTime();
    const certificateName = `cert${uniqueString}`;
  
    // Creating a self-signed certificate
    const createPoller = await client.beginCreateCertificate(
      certificateName,
      DefaultCertificatePolicy
    );
  
    const pendingCertificate = createPoller.getResult();
    console.log("Certificate: ", pendingCertificate);
  
    // To read a certificate with their policy:
    let certificateWithPolicy = await client.getCertificate(certificateName);
    // Note: It will always read the latest version of the certificate.
  
    console.log("Certificate with policy:", certificateWithPolicy);
  
    // To read a certificate from a specific version:
    const certificateFromVersion = await client.getCertificateVersion(
      certificateName,
      certificateWithPolicy.properties.version
    );
    // Note: It will not retrieve the certificate's policy.
    console.log("Certificate from a specific version:", certificateFromVersion);
  
    const updatedCertificate = await client.updateCertificateProperties(certificateName, "", {
      tags: {
        customTag: "value"
      }
    });
    console.log("Updated certificate:", updatedCertificate);
  
    // Updating the certificate's policy:
    await client.updateCertificatePolicy(certificateName, {
      issuerName: "Self",
      subject: "cn=MyOtherCert"
    });
    certificateWithPolicy = await client.getCertificate(certificateName);
    console.log("updatedCertificate certificate's policy:", certificateWithPolicy.policy);
  
    // delete certificate
    const deletePoller = await client.beginDeleteCertificate(certificateName);
    const deletedCertificate = await deletePoller.pollUntilDone();
    console.log("Recovery Id: ", deletedCertificate.recoveryId);
    console.log("Deleted Date: ", deletedCertificate.deletedOn);
    console.log("Scheduled Purge Date: ", deletedCertificate.scheduledPurgeDate);
  }
  
  main().catch((error) => {
    console.error("An error occurred:", error);
    process.exit(1);
  });
  

Ausführen der Beispielanwendung

1. Führen Sie die App aus:

   node index.js
   

2. Die Methoden create und get geben ein vollständiges JSON-Objekt für das Zertifikat zurück:

   {
     "keyId": undefined,
     "secretId": undefined,
     "name": "YOUR-CERTIFICATE-NAME",
       "reuseKey": false,
       "keyCurveName": undefined,
       "exportable": true,
       "issuerName": 'Self',
       "certificateType": undefined,
       "certificateTransparency": undefined
     },
     "properties": {
       "createdOn": 2021-11-29T20:17:45.000Z,
       "updatedOn": 2021-11-29T20:17:45.000Z,
       "expiresOn": 2022-11-29T20:17:45.000Z,
       "id": "https://YOUR-KEY-VAULT-NAME-ENDPOINT/certificates/YOUR-CERTIFICATE-NAME/YOUR-CERTIFICATE-VERSION",
       "enabled": false,
       "notBefore": 2021-11-29T20:07:45.000Z,
       "recoveryLevel": "Recoverable+Purgeable",
       "name": "YOUR-CERTIFICATE-NAME",
       "vaultUrl": "https://YOUR-KEY-VAULT-NAME-ENDPOINT",
       "version": "YOUR-CERTIFICATE-VERSION",
       "tags": undefined,
       "x509Thumbprint": undefined,
       "recoverableDays": 90
     }
   }
   

• Erstellen Sie eine neue Textdatei, und fügen Sie den folgenden Code in die Datei index.js ein.

  import {
    CertificateClient,
    DefaultCertificatePolicy,
    KeyVaultCertificate,
    DeletedCertificate,
    CertificatePolicy,
    KeyVaultCertificateWithPolicy,
  } from "@azure/keyvault-certificates";
  import { DefaultAzureCredential } from "@azure/identity";
  import "dotenv/config";
  
  const credential = new DefaultAzureCredential();
  
  // Get Key Vault name from environment variables
  // such as `https://${keyVaultName}.vault.azure.net`
  const keyVaultUrl = process.env.KEY_VAULT_URL;
  if (!keyVaultUrl) throw new Error("KEY_VAULT_URL is empty");
  
  function printCertificate(
    certificate: KeyVaultCertificate | KeyVaultCertificateWithPolicy
  ): void {
    console.log("-- printCertificate ---------------------------");
  
    // if policy is defined, it's a KeyVaultCertificateWithPolicy
    if ((certificate as KeyVaultCertificateWithPolicy).policy) {
      const { name, properties, policy } =
        certificate as KeyVaultCertificateWithPolicy;
      const { createdOn, updatedOn, expiresOn, vaultUrl, version, tags } =
        properties;
      console.log("Certificate: ", {
        name,
        createdOn,
        updatedOn,
        expiresOn,
        vaultUrl,
        version,
      });
      console.log("Certificate Policy: ", policy);
      printObjectProperties(tags);
      return;
    } else {
      const { name, properties } = certificate;
      const { createdOn, updatedOn, expiresOn, vaultUrl, version, tags } =
        properties;
      console.log("Certificate: ", {
        name,
        createdOn,
        updatedOn,
        expiresOn,
        vaultUrl,
        version,
      });
      printObjectProperties(tags);
    }
  }
  // Object properties are tags and CertificatePolicy
  function printObjectProperties(obj: Record<string, any>): void {
    if (!obj) return;
  
    console.log("-- printObjectProperties ---------------------------");
  
    Object.entries(obj).forEach(([key, value]) => {
      if (key === "lifetimeActions") {
        console.log(`${key}: ${JSON.stringify(value)}`);
      } else {
        console.log(`${key}: ${value}`);
      }
    });
  }
  function printDeletedCertificate(deletedCertificate: DeletedCertificate): void {
    const { recoveryId, deletedOn, scheduledPurgeDate } = deletedCertificate;
    console.log("Deleted Certificate: ", {
      recoveryId,
      deletedOn,
      scheduledPurgeDate,
    });
  }
  async function main(): Promise<void> {
    // Create a new CertificateClient
    const client = new CertificateClient(keyVaultUrl, credential);
  
    // Create a unique certificate name
    const uniqueString = new Date().getTime().toString();
    const certificateName = `cert${uniqueString}`;
  
    // Creating a self-signed certificate
    const createPoller = await client.beginCreateCertificate(
      certificateName,
      DefaultCertificatePolicy
    );
  
    // Get the created certificate
    const pendingCertificate = await createPoller.getResult();
    printCertificate(pendingCertificate);
  
    // Get certificate by name
    let certificateWithPolicy = await client.getCertificate(certificateName);
    printCertificate(pendingCertificate);
  
    // Get certificate by version
    const certificateFromVersion = await client.getCertificateVersion(
      certificateName,
      certificateWithPolicy.properties.version!
    );
    printCertificate(certificateFromVersion);
  
    // Update properties of the certificate
    const updatedCertificate = await client.updateCertificateProperties(
      certificateName,
      certificateWithPolicy.properties.version!,
      {
        tags: {
          customTag: "my value",
        },
      }
    );
    printCertificate(updatedCertificate);
  
    // Updating the certificate's policy
    const certificatePolicy = await client.updateCertificatePolicy(
      certificateName,
      {
        issuerName: "Self",
        subject: "cn=MyOtherCert",
      }
    );
    printObjectProperties(certificatePolicy);
  
    // Get certificate again to see the updated policy
    certificateWithPolicy = await client.getCertificate(certificateName);
    printCertificate(certificateWithPolicy);
  
    // Delete certificate
    const deletePoller = await client.beginDeleteCertificate(certificateName);
    const deletedCertificate = await deletePoller.pollUntilDone();
    printDeletedCertificate(deletedCertificate);
  }
  
  main().catch((error) => {
    console.error("An error occurred:", error);
    process.exit(1);
  });
  

Ausführen der Beispielanwendung

1. Erstellen Sie die TypeScript-App:

   tsc
   

2. Führen Sie die App aus:

   node index.js
   

3. Die Methoden create und get geben ein vollständiges JSON-Objekt für das Zertifikat zurück:

   {
     "keyId": undefined,
     "secretId": undefined,
     "name": "YOUR-CERTIFICATE-NAME",
       "reuseKey": false,
       "keyCurveName": undefined,
       "exportable": true,
       "issuerName": 'Self',
       "certificateType": undefined,
       "certificateTransparency": undefined
     },
     "properties": {
       "createdOn": 2021-11-29T20:17:45.000Z,
       "updatedOn": 2021-11-29T20:17:45.000Z,
       "expiresOn": 2022-11-29T20:17:45.000Z,
       "id": "https://YOUR-KEY-VAULT-NAME-ENDPOINT/certificates/YOUR-CERTIFICATE-NAME/YOUR-CERTIFICATE-VERSION",
       "enabled": false,
       "notBefore": 2021-11-29T20:07:45.000Z,
       "recoveryLevel": "Recoverable+Purgeable",
       "name": "YOUR-CERTIFICATE-NAME",
       "vaultUrl": "https://YOUR-KEY-VAULT-NAME-ENDPOINT",
       "version": "YOUR-CERTIFICATE-VERSION",
       "tags": undefined,
       "x509Thumbprint": undefined,
       "recoverableDays": 90
     }
   }