使用Java SDK从Azure KeyVault下载PFX证书遇异常求助

问题详情 #

使用Java SDK从Azure KeyVault下载PFX格式证书后，无法像上传前的原始十六进制编码PFX文件那样正常打开。带密码和不带密码的PFX文件均出现此问题：

• 下载生成的十六进制文件有373行、14919个字符，无法打开
• 上传前的原始PFX十六进制文件有374行、14947个字符
• 使用Keystore Explorer测试时，无论使用原密码还是空白密码，均报错：test.pfx is not a KeyStore of any of the following recognized types: JCE, JCEKS, PKCS#12, UBER or BCFKS
• 手动从KeyVault GUI下载的PFX证书可正常使用

代码实现 #

主代码实现 #

public static void main(String[] args) throws Exception {

    System.setProperty("AZURE_CLIENT_ID", "...");
    System.setProperty("AZURE_CLIENT_SECRET", "...");
    System.setProperty("AZURE_TENANT_ID", "...");
    final DefaultAzureCredential azureCredential = new DefaultAzureCredentialBuilder()
            .build();
    CertificateClient certificateClient = new CertificateClientBuilder()
            .vaultUrl("https://djangofan-kv-test.vault.azure.net")
            .credential(azureCredential)
            .buildClient();

    String certificateName = "test";

    KeyVaultCertificateWithPolicy certificate = certificateClient.getCertificate(certificateName);
    CertificateKeyType keyType = certificate.getPolicy().getKeyType();
    System.out.println("\nKey type: " + keyType);

    String secretIdAndUrl = certificate.getKeyId();
    System.out.println("\nSecret ID: " + secretIdAndUrl);

    String secretValue = secretClient.getSecret(certificateName).getValue();
    System.out.println("\nSecret value:\n" + secretValue);

    Base64.Decoder decoder = Base64.getDecoder();
    byte[] decodedBytes = decoder.decode(secretValue);
    System.out.println("\nSecret value decoded:\n" + Arrays.toString(decodedBytes));

    String hexData = bytesToHex(decodedBytes);
    System.out.println("\nSecret value HEX dump:\n" + hexData);
    try (BufferedWriter writer = new BufferedWriter(new FileWriter("test.pfx", StandardCharsets.UTF_8))) {
        writer.write(hexData);
    }
    System.exit(0);
}

使用SecretsClient的尝试代码 #

SecretClient secretClient = new SecretClientBuilder()
        .vaultUrl("https://djangofan-kv-test.vault.azure.net")
        .credential(azureCredential)
        .buildClient();
String secretName = "secretnopass";
KeyVaultSecret secret = secretClient.getSecret(secretName);
String secretValue = secret.getValue();
System.out.println("\nSecret value:\n" + secretValue);
String hexData = bytesToHex(secretValue.getBytes(StandardCharsets.UTF_8));
System.out.println("\nSecret value HEX dump:\n" + hexData);

Maven依赖 #

<dependency>
  <groupId>com.azure</groupId>
  <artifactId>azure-security-keyvault-certificates</artifactId>
  <version>4.3.0</version>
</dependency>
<dependency>
  <groupId>com.azure</groupId>
  <artifactId>azure-security-keyvault-secrets</artifactId>
  <version>4.3.0</version>
</dependency>
<dependency>
  <groupId>com.azure</groupId>
  <artifactId>azure-identity</artifactId>
  <version>1.3.5</version>
</dependency>

内容的提问来源于stack exchange，提问作者djangofan