Import-AzKeyVaultCertificate cmdlet 结果：密钥对处于指定状态的用户无效

Question

我正在尝试将 .pfx 证书导入 Azure keyvault，但遇到了一些问题。

Import-AzKeyVaultCertificate -VaultName "SecHash03" -Name "CodeSigning" -FilePath "\path\to\my\cert.pfx"

结果：

Import-AzKeyVaultCertificate : Key not valid for use in specified state.
At line:1 char:1
+ Import-AzKeyVaultCertificate -VaultName SecHash03 -Name " ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Import-AzKeyVaultCertificate], CryptographicException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.ImportAzureKeyVaultCertificate

我正在使用 certreq 从与 CA 位于同一域的计算机上向企业 CA 请求此证书。导入证书不需要密码。计划是将该证书上传到上述 Azure keyvault。

我尝试使用 Azure 门户导入此证书并且效果很好；导入和使用都很好。因此，这不是另一个类似 Whosebug 答案 () 中建议的角色问题。

请指教！

Answer 1

据我所知，当您将 pre-existing .pfx 文件证书导入到 Azure 密钥保管库时，您需要提供用于保护证书的密码，因为您需要在其中导出证书私钥并尽可能在证书路径中包含所有证书。例如，

# Export the cert to a PFX with password
$password = ConvertTo-SecureString "Password!" -AsPlainText -Force
Export-PfxCertificate -Cert "cert:\CurrentUser\My$($cert.Thumbprint)" -FilePath C:\temp\cert2.pfx -Password $password

# Upload to Key Vault
Import-AzureKeyVaultCertificate -VaultName noel-temp -Name cert2 -FilePath C:\temp\cert2.pfx -Password $password

或者，

If you use a supported CA, you can even configure Key Vault to enroll for certificates on your behalf. No leaking of keys! For simplicity, the policy in these examples will be set to generate self-signed certs from Key Vault.

# Have Key Vault create the certificate with a simple policy
$policy = New-AzureKeyVaultCertificatePolicy -SubjectName "CN=mycluster.southcentralus.cloudapp.azure.com" -IssuerName Self -ValidityInMonths 12
Add-AzureKeyVaultCertificate -VaultName noel-temp -Name cert1 -CertificatePolicy $policy

# Download the secret (private key information) associated with the cert
$secret = Get-AzureKeyVaultSecret -VaultName noel-temp -Name cert1
$secretBytes = [System.Convert]::FromBase64String($secret.SecretValueText)
[System.IO.File]::WriteAllBytes("C:\temp\cert1.pfx", $secretBytes)

# Import the certificate to CurrentUser\My
Import-PfxCertificate -FilePath C:\temp\cert1.pfx -CertStoreLocation cert:\CurrentUser\My -Exportable

您可以从这两个链接获得更多详细信息：

Importing Certificates to Key Vault

Manage certificates via Azure Key Vault

Import-AzKeyVaultCertificate cmdlet 结果：密钥对处于指定状态的用户无效

Import-AzKeyVaultCertificate cmdlet results in: Key not valid for user in specified state

azure

import

certificate

azure-powershell

azure-keyvault