在APIM策略中通过ID检索证书的需求及现有问题

DevOps 小满

2026-6-12

APIM策略通过证书ID检索证书的实现方案

问题背景

我有一个基于私钥证书生成JWT令牌的APIM策略，已通过Key Vault引用将证书部署到APIM中。但目前策略仅能通过证书指纹检索证书，Key Vault证书轮换后指纹会变更，每次都要更新策略中指向指纹的命名值，非常繁琐。希望能直接通过证书ID检索APIM中的证书。

当前实现代码

string certificateId = "CERTIFICATETHUMBPRINT";
if (!context.Deployment.Certificates.TryGetValue(certificateId, out var certificate))
{
    throw new Exception($"Certificate for Oracle not found. Available certificates: {string.Join(", ", context.Deployment.Certificates.Keys)}");
}

期望实现写法

var certificate = context.Deployment.Certificates["CertificateId"];

解决方案

APIM的context.Deployment.Certificates集合默认以证书指纹作为键，但可以通过遍历证书对象的Id属性匹配目标证书，实现按ID检索的效果：

实现代码

var targetCertificateId = "YOUR_TARGET_CERTIFICATE_ID";
var certificate = context.Deployment.Certificates.Values
    .FirstOrDefault(c => c.Id.Equals(targetCertificateId, StringComparison.OrdinalIgnoreCase));

if (certificate == null)
{
    var availableCerts = string.Join(", ", context.Deployment.Certificates.Values
        .Select(c => $"{c.Id} (Thumbprint: {c.Thumbprint})"));
    throw new Exception($"Certificate with ID {targetCertificateId} not found. Available certificates: {availableCerts}");
}