使用.NET KeyVault证书客户端执行非集成CA证书相关操作的可行性

请问使用.NET KeyVault Certificate Client是否可以执行以下操作：

1. 创建由非集成CA签发的证书，并将其置于“In progress”状态；
2. 下载关联的CSR（证书签名请求）；
3. 上传（合并）已签名的请求。

补充说明：PowerShell中执行Add-AzKeyVaultCertificate请求时会返回CSR，希望.NET客户端也能实现相同功能，相关PowerShell示例及输出如下：

$policy = New-AzKeyVaultCertificatePolicy -SubjectName "CN=www.contosoHRApp.com" -ValidityInMonths 1  -IssuerName Unknown
$csr = Add-AzKeyVaultCertificate -VaultName ContosoKV -Name ContosoManualCSRCertificate -CertificatePolicy $policy
$csr.CertificateSigningRequest

输出内容：

Id                        : https://XXX.vault.azure.net/certificates/POWERSHELL/pending
Status                    : inProgress
StatusDetails             : Pending certificate created. Please Perform Merge to complete the request.
RequestId                 : c22693443ae94c70b2603cb8e09ebb2a
Target                    :
Issuer                    : Unknown
CancellationRequested     : False
CertificateSigningRequest : MIICqTCCAZECAQAwGTEXMBUGA1UEAxMOUE9XRVJTSEVMTFRFU1QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoI
                            BAQDC/Z/CIpVIqeBLLxoMxJxOZIqDhK84ZRDiGtRSqd5SxFOkKWlFaPxuxoLvWzOWphH2HS9gzm0Fg1dHpF7vHzGnY9
                            HTVM41ODhjwM/BVRF+eCjVecrEUXN+dty+ti/R/Nq8q7kgvxQUtY6dZM2R1qkDgJBtYOlhfm9HTdMUxoxXe/sDDpGB4
                            HDIN/5TeoB3IGY4gV/u+zRbQt8Llf9VCLajoubYDiij+LvuFxAftnzX8QB1lXqO7xuyF4I7Be6PCYScQ6OgVhSBhAMC
                            Pd3hdG0MS7nTXAgdFymFio+gZ2Y0HEQxgvIGSCWmXyjEf0OaiQSE6MBeX/1Rw2fHnA3/44bxAgMBAAGgSzBJBgkqhki
                            G9w0BCQ4xPDA6MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwCQYDVR0TBAIwAD
                            ANBgkqhkiG9w0BAQsFAAOCAQEAsL8sWnKBl0x2qy/DDwlJGwOwaQF+SIjtfMxXqLCtFt+Gaa0rOYhbvRSV0G6XZjBc1
                            Foc5eRysxy7Ts90p2Z+sxRNqeOJo83v+bhYKs4KmUKyZmKLW/CG70hpKG/HJBabSD68EaYt1bxKa4s5yjI5bDAQyDIR
                            nYAkGc5zhgVbk68moApMDDDQTVxdgpIoG0rYywHyXSi15GOnXbdWRXObwWu/ReNzn75hmEffChw0a8SYTVurXQDarIY
                            qoCD9nGzE468G9yL8ogvxu5zNZ7C1Sq3j2D7eIDK+KARk8HGY61yMInuLqsANpTy0e8UKuzY3TGxaj7L5CibDsyW6CF
                            Z4Mw==
ErrorCode                 :
ErrorMessage              :
Name                      :
VaultName                 :

答案 #

这三个操作都可以通过.NET的Azure Key Vault证书客户端实现，具体步骤和代码示例如下：

1. 创建待签名的证书（In Progress状态） #

通过CertificateClient.StartCreateCertificateAsync方法发起证书创建请求，只需在证书策略中指定IssuerName = "Unknown"，Key Vault就会生成CSR并将证书标记为inProgress状态。

using Azure.Security.KeyVault.Certificates;
using Azure.Identity;

var vaultUri = new Uri("https://your-vault-name.vault.azure.net/");
var client = new CertificateClient(vaultUri, new DefaultAzureCredential());

// 构造证书策略，指定未知签发者和证书主题
var policy = new CertificatePolicy(
    issuerName: "Unknown",
    subject: "CN=www.contosoHRApp.com")
{
    ValidityInMonths = 1
};

// 启动证书创建操作
var createOperation = await client.StartCreateCertificateAsync(
    certificateName: "ContosoManualCSRCertificate",
    policy: policy);

// 等待操作完成，获取待处理的证书请求
var pendingCertificate = await createOperation.WaitForCompletionAsync();

2. 获取CSR内容 #

从返回的PendingCertificateOperation对象中，直接读取CertificateSigningRequest属性即可拿到Base64编码的CSR内容，和PowerShell返回的结果完全一致。

// 提取CSR的Base64内容
string csrBase64 = pendingCertificate.Value.CertificateSigningRequest;
Console.WriteLine("生成的CSR：");
Console.WriteLine(csrBase64);

3. 合并已签名的证书 #

将CA签发完成的证书（PEM或CER格式）转换为纯Base64编码（去除头部尾部和换行），然后调用CertificateClient.MergeCertificateAsync方法上传并合并，完成整个证书签发流程。

// 读取已签名的证书文件（示例为PEM格式）
string signedCertPem = await File.ReadAllTextAsync("signed-contoso-cert.pem");
// 清理PEM格式，保留纯Base64字符串
string signedCertBase64 = signedCertPem
    .Replace("-----BEGIN CERTIFICATE-----", "")
    .Replace("-----END CERTIFICATE-----", "")
    .Replace("\r", "")
    .Replace("\n", "");

// 执行证书合并操作
var mergeOperation = await client.MergeCertificateAsync(
    certificateName: "ContosoManualCSRCertificate",
    new[] { Convert.FromBase64String(signedCertBase64) });

Console.WriteLine($"证书合并完成，当前状态：{mergeOperation.Value.Properties.Status}");

内容的提问来源于stack exchange，提问作者CM231