PowerShell从Azure Key Vault导入证书到X509Certificate2遇错求助

问题说明 #

通过Get-AzKeyVaultSecret从Azure Key Vault获取的证书内容为PEM格式（包含私钥和证书链），直接转Base64会因页眉页脚、换行等非Base64字符报错；使用ConvertFrom-SecureString转换得到的是加密字符串，无法被X509Certificate2.Import识别。

解决方案 #

方法一：用OpenSSL转换为PFX格式（简单直接） #

1. 导出PEM内容到本地文件

$secret = Get-AzKeyVaultSecret -VaultName "<vaultName>" -Name "<certName>"
$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secret.SecretValue)
try {
    $secretValueText = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)
} finally {
    [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)
}
# 将PEM内容写入ASCII编码文件
$secretValueText | Out-File -FilePath "cert.pem" -Encoding ASCII

2. 转换PEM为PFX格式
   打开命令提示符或PowerShell，执行OpenSSL命令（需提前安装OpenSSL）：

openssl pkcs12 -export -in cert.pem -out cert.pfx -passout pass:

-passout pass: 表示设置空密码，若需密码可替换为pass:yourpassword。

3. 导入PFX到X509Certificate2

$pfxBytes = Get-Content "cert.pfx" -AsByteStream
$authcert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$authcert.Import($pfxBytes, "", "Exportable,PersistKeySet")

方法二：用BouncyCastle库纯PowerShell处理（无需外部工具） #

1. 安装BouncyCastle库

Install-Package BouncyCastle -Provider NuGet -Scope CurrentUser

2. 解析PEM并转换为PFX字节

# 加载BouncyCastle程序集（路径根据实际安装版本调整）
Add-Type -Path "$env:USERPROFILE\Documents\WindowsPowerShell\Modules\BouncyCastle\1.8.10\lib\netstandard2.0\BouncyCastle.Crypto.dll"

# 获取并读取PEM内容
$secret = Get-AzKeyVaultSecret -VaultName "<vaultName>" -Name "<certName>"
$ssPtr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secret.SecretValue)
try {
    $secretValueText = [System.Runtime.InteropServices.Marshal]::PtrToStringBSTR($ssPtr)
} finally {
    [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ssPtr)
}

# 解析PEM中的私钥和证书链
$reader = New-Object Org.BouncyCastle.OpenSsl.PemReader([System.IO.StringReader]$secretValueText)
$objects = @()
while ($obj = $reader.ReadObject()) {
    $objects += $obj
}
$privateKey = $objects | Where-Object { $_ -is [Org.BouncyCastle.Crypto.AsymmetricKeyParameter] }
$certificates = $objects | Where-Object { $_ -is [Org.BouncyCastle.X509.X509Certificate] }

# 创建PKCS#12存储并导出为字节数组
$store = New-Object Org.BouncyCastle.Pkcs.Pkcs12Store
$alias = "imported-cert"
$store.SetKeyEntry($alias, [Org.BouncyCastle.Pkcs.AsymmetricKeyEntry]$privateKey, [Org.BouncyCastle.X509.X509Certificate[]]$certificates)

$ms = New-Object System.IO.MemoryStream
$store.Save($ms, [char[]]"", [Org.BouncyCastle.Security.SecureRandom]::new())
$pfxBytes = $ms.ToArray()
$ms.Dispose()

# 导入到X509Certificate2
$authcert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$authcert.Import($pfxBytes, "", "Exportable,PersistKeySet")

关键说明 #

• ConvertFrom-SecureString生成的是Windows DPAPI加密字符串，并非证书明文，因此无法直接导入。
• PEM格式的私钥和证书链需转换为PKCS#12（PFX）格式，才能被X509Certificate2正确识别并导入私钥。

内容的提问来源于stack exchange，提问作者Phil