基于.NET的Azure Function借助Azure Key Vault生成客户端证书咨询

Got it, let's tackle this problem together. You've already got your root certificate stored in Azure Key Vault, and now you need a .NET-based Azure Function to generate client certificates with a special ID using that root cert—since PowerShell isn't cutting it. Here's a step-by-step implementation you can follow:

First, add these packages to your Azure Function project (via NuGet Package Manager or CLI):

• Azure.Security.KeyVault.Certificates (for interacting with Key Vault certificates)
• Azure.Security.KeyVault.Keys (to access the root cert's private key)
• Azure.Identity (for authenticating to Key Vault using managed identity)
• Microsoft.Azure.WebJobs.Extensions.Http (if using an HTTP trigger)

Your Azure Function needs permissions to access the root certificate and its private key in Key Vault:

1. Enable system-assigned managed identity for your Azure Function in the Azure Portal.
2. Go to your Key Vault's Access Policies, add a new policy:
   • Select the managed identity of your Function as the principal.
   • Grant these permissions:
     • Certificates: Get
     • Keys: Get (required to retrieve the root cert's private key for signing)

Here's a complete example using an HTTP trigger. This function will accept a specialId parameter, generate a client certificate signed by your root cert, and return it as a PFX file:

using System;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;
using Azure.Security.KeyVault.Certificates;
using Azure.Security.KeyVault.Keys;
using Azure.Identity;
using System.Security.Cryptography.X509Certificates;
using System.Security.Cryptography;

namespace ClientCertGenerator
{
    public static class GenerateSignedClientCert
    {
        [FunctionName("GenerateSignedClientCert")]
        public static async Task<IActionResult> Run(
            [HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)] HttpRequest req,
            ILogger log)
        {
            log.LogInformation("Starting client certificate generation process.");

            // Retrieve the special ID from the request (adjust this to your input method)
            string specialId = req.Query["specialId"];
            if (string.IsNullOrWhiteSpace(specialId))
            {
                return new BadRequestObjectResult("Please provide a 'specialId' query parameter.");
            }

            // Load Key Vault URL from environment variables (set in Function App configuration)
            string keyVaultUrl = Environment.GetEnvironmentVariable("KEY_VAULT_URL");
            if (string.IsNullOrWhiteSpace(keyVaultUrl))
            {
                return new StatusCodeResult(StatusCodes.Status500InternalServerError);
            }

            // Initialize Key Vault clients
            var certClient = new CertificateClient(new Uri(keyVaultUrl), new DefaultAzureCredential());
            var keyClient = new KeyClient(new Uri(keyVaultUrl), new DefaultAzureCredential());

            // Fetch your root certificate from Key Vault (replace with your root cert name)
            const string rootCertName = "MyRootCA";
            var rootCertBundle = await certClient.GetCertificateAsync(rootCertName);
            var rootKey = await keyClient.GetKeyAsync(rootCertBundle.Properties.KeyId.Name);

            // Convert root cert to X509Certificate2 with private key
            var rootCert = new X509Certificate2(rootCertBundle.Cer);
            using var rootRsa = RSA.Create();
            rootRsa.ImportRSAPrivateKey(Convert.FromBase64String(rootKey.Key.ToRSA().ExportRSAPrivateKeyPem()), out _);
            rootCert = rootCert.CopyWithPrivateKey(rootRsa);

            // Create client certificate request with the special ID in the subject
            var clientCertSubject = new X500DistinguishedName($"CN={specialId}, OU=ClientCerts, O=YourOrganization");
            using var clientRsa = RSA.Create(2048); // Use 4096 for higher security if needed

            var certRequest = new CertificateRequest(
                clientCertSubject,
                clientRsa,
                HashAlgorithmName.SHA256,
                RSASignaturePadding.Pkcs1);

            // Configure certificate validity (1 year in this example)
            certRequest.CertificateValidityPeriod = TimeSpan.FromDays(365);

            // Add client authentication enhanced key usage (required for TLS client auth)
            certRequest.CertificateExtensions.Add(
                new X509EnhancedKeyUsageExtension(
                    new OidCollection { new Oid("1.3.6.1.5.5.7.3.2") }, // Client Authentication OID
                    false));

            // Optional: Add custom extension to embed the special ID (if you need it outside the subject)
            // certRequest.CertificateExtensions.Add(
            //     new X509Extension("1.2.3.4.5.6.7.8", System.Text.Encoding.ASCII.GetBytes(specialId), false));

            // Sign the client certificate with the root CA
            var clientCert = certRequest.Create(
                issuerCertificate: rootCert,
                notBefore: DateTimeOffset.UtcNow,
                notAfter: DateTimeOffset.UtcNow.AddYears(1),
                serialNumber: Guid.NewGuid().ToByteArray()); // Unique serial number

            // Export the client cert as PFX (with password protection)
            string pfxPassword = "your-cert-password-here"; // Use a secure secret from Key Vault in production
            var pfxBytes = clientCert.Export(X509ContentType.Pfx, pfxPassword);

            // Return the PFX file for download
            return new FileContentResult(pfxBytes, "application/x-pkcs12")
            {
                FileDownloadName = $"client-cert-{specialId}.pfx"
            };
        }
    }
}

• Root Certificate Requirements: Your root cert in Key Vault must include its private key (import it as a PFX file with private key). Without the private key, you can't sign client certificates.
• Environment Variables: Set KEY_VAULT_URL in your Function App's Configuration tab (under Settings > Configuration) to avoid hardcoding.
• Secure Passwords: In production, store the PFX password in Key Vault and retrieve it using SecretClient instead of hardcoding.
• Special ID Placement: If you don't want the special ID in the certificate subject, use a custom X509 extension (uncomment the optional code block) to embed it.
• Scaling: This function can be scaled like any other Azure Function, but ensure Key Vault has sufficient throughput for your certificate generation volume.

内容的提问来源于stack exchange，提问作者Merian07