如何通过C#代码在Azure设备预配服务(DPS)中程序化上传证书？能否调用Key Vault证书？

一、C#实现DPS证书上传 #

你已经找到的CLI命令和REST API是正确的，C#实现有两种常用方案：

方案1：使用Azure官方管理SDK #

首先安装所需NuGet包：

• Microsoft.Azure.Management.DeviceProvisioningServices
• Azure.Identity
  示例代码如下：

using Azure.Identity;
using Microsoft.Azure.Management.DeviceProvisioningServices;
using Microsoft.Azure.Management.DeviceProvisioningServices.Models;
using System.IO;

// 配置参数
var subscriptionId = "你的订阅ID";
var resourceGroupName = "资源组名称";
var dpsName = "DPS实例名称";
var certName = "上传后证书的名称";
var certPath = "本地证书.pem路径";
var tenantId = "Azure租户ID";
var clientId = "服务主体客户端ID";
var clientSecret = "服务主体客户端密钥";

// 身份验证
var credentials = new ClientSecretCredential(tenantId, clientId, clientSecret);
var token = await credentials.GetTokenAsync(new Azure.Core.TokenRequestContext(new[] { "https://management.azure.com/.default" }));
var dpsClient = new IotDpsClient(new Microsoft.Rest.TokenCredentials(token.Token))
{
    SubscriptionId = subscriptionId
};

// 读取并处理证书内容
var rawCertContent = File.ReadAllText(certPath);
var validCertContent = rawCertContent.Replace("\r\n", "").Replace("-----BEGIN CERTIFICATE-----", "").Replace("-----END CERTIFICATE-----", "");

// 上传证书到DPS
var certificate = await dpsClient.DpsCertificate.CreateOrUpdateAsync(
    resourceGroupName,
    dpsName,
    certName,
    new CertificateBodyDescription(certificate: validCertContent)
);

方案2：直接调用REST API #

如果不想依赖额外SDK，可直接用HttpClient调用REST接口，示例代码：

using Azure.Identity;
using System.Net.Http;
using System.Net.Http.Headers;
using System.IO;
using System.Text.Json;

// 配置参数
var subscriptionId = "你的订阅ID";
var resourceGroupName = "资源组名称";
var dpsName = "DPS实例名称";
var certName = "上传后证书的名称";
var certPath = "本地证书.pem路径";
var apiVersion = "2018-01-22";

// 身份验证获取访问令牌
var credentials = new DefaultAzureCredential();
var token = await credentials.GetTokenAsync(new Azure.Core.TokenRequestContext(new[] { "https://management.azure.com/.default" }));

// 构造请求参数
var requestUrl = $"https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Devices/provisioningServices/{dpsName}/certificates/{certName}?api-version={apiVersion}";
var rawCertContent = File.ReadAllText(certPath);
var validCertContent = rawCertContent.Replace("\r\n", "").Replace("-----BEGIN CERTIFICATE-----", "").Replace("-----END CERTIFICATE-----", "");
var requestBody = new { properties = new { certificate = validCertContent } };
var content = new StringContent(JsonSerializer.Serialize(requestBody));
content.Headers.ContentType = new MediaTypeHeaderValue("application/json");

// 发送上传请求
using var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.Token);
var response = await httpClient.PutAsync(requestUrl, content);
// 校验请求是否成功
response.EnsureSuccessStatusCode();

DPS上传证书的界面参考：

二、Azure Key Vault证书使用说明 #

目前DPS不支持直接关联拉取Key Vault中存储的证书，你可以按以下流程实现间接使用：

1. 程序首先通过Key Vault SDK读取证书内容
2. 将读取到的证书内容通过上述上传接口提交到DPS
   从Key Vault读取证书的示例代码如下：

using Azure.Identity;
using Azure.Security.KeyVault.Certificates;

// 配置参数
var keyVaultUrl = "https://你的密钥保管库名称.vault.azure.cn/";
var certNameInKv = "Key Vault中存储的证书名称";

// 读取Key Vault中的证书
var client = new CertificateClient(new Uri(keyVaultUrl), new DefaultAzureCredential());
var kvCert = await client.DownloadCertificateAsync(certNameInKv);
// 转换为标准PEM格式即可用于后续DPS上传
var pemCert = "-----BEGIN CERTIFICATE-----\n" + Convert.ToBase64String(kvCert.Value.RawData, Base64FormattingOptions.InsertLineBreaks) + "\n-----END CERTIFICATE-----";

内容的提问来源于stack exchange，提问作者draco951