快速入门：适用于 JavaScript 的 Azure 密钥保管库证书客户端库

先决条件

• Azure 订阅 - 创建试用版订阅。
• 当前 Node.js LTS。
• Azure CLI
• 现有的 Key Vault - 可以使用以下方法创建一个：
  • Azure CLI
  • Azure 门户
  • Azure PowerShell

• Azure 订阅 - 创建试用版订阅。
• 当前 Node.js LTS。
• TypeScript 5+
• Azure CLI
• 现有的 Key Vault - 可以使用以下方法创建一个：
  • Azure CLI
  • Azure 门户
  • Azure PowerShell

• 创建新文本文件并将以下代码粘贴到 index.js 文件中。

  const { CertificateClient, DefaultCertificatePolicy } = require("@azure/keyvault-certificates");
  const { DefaultAzureCredential } = require("@azure/identity");
  
  async function main() {
    // If you're using MSI, DefaultAzureCredential should "just work".
    // Otherwise, DefaultAzureCredential expects the following three environment variables:
    // - AZURE_TENANT_ID: The tenant ID in Microsoft Entra ID
    // - AZURE_CLIENT_ID: The application (client) ID registered in the AAD tenant
    // - AZURE_CLIENT_SECRET: The client secret for the registered application
    const credential = new DefaultAzureCredential();
  
    const keyVaultUrl = process.env["KEY_VAULT_URL"];
    if(!keyVaultUrl) throw new Error("KEY_VAULT_URL is empty");
  
    const client = new CertificateClient(keyVaultUrl, credential);
  
    const uniqueString = new Date().getTime();
    const certificateName = `cert${uniqueString}`;
  
    // Creating a self-signed certificate
    const createPoller = await client.beginCreateCertificate(
      certificateName,
      DefaultCertificatePolicy
    );
  
    const pendingCertificate = createPoller.getResult();
    console.log("Certificate: ", pendingCertificate);
  
    // To read a certificate with their policy:
    let certificateWithPolicy = await client.getCertificate(certificateName);
    // Note: It will always read the latest version of the certificate.
  
    console.log("Certificate with policy:", certificateWithPolicy);
  
    // To read a certificate from a specific version:
    const certificateFromVersion = await client.getCertificateVersion(
      certificateName,
      certificateWithPolicy.properties.version
    );
    // Note: It will not retrieve the certificate's policy.
    console.log("Certificate from a specific version:", certificateFromVersion);
  
    const updatedCertificate = await client.updateCertificateProperties(certificateName, "", {
      tags: {
        customTag: "value"
      }
    });
    console.log("Updated certificate:", updatedCertificate);
  
    // Updating the certificate's policy:
    await client.updateCertificatePolicy(certificateName, {
      issuerName: "Self",
      subject: "cn=MyOtherCert"
    });
    certificateWithPolicy = await client.getCertificate(certificateName);
    console.log("updatedCertificate certificate's policy:", certificateWithPolicy.policy);
  
    // delete certificate
    const deletePoller = await client.beginDeleteCertificate(certificateName);
    const deletedCertificate = await deletePoller.pollUntilDone();
    console.log("Recovery Id: ", deletedCertificate.recoveryId);
    console.log("Deleted Date: ", deletedCertificate.deletedOn);
    console.log("Scheduled Purge Date: ", deletedCertificate.scheduledPurgeDate);
  }
  
  main().catch((error) => {
    console.error("An error occurred:", error);
    process.exit(1);
  });
  

运行示例应用程序

1. 运行应用：

   node index.js
   

2. create 和 get 方法为证书返回完整的 JSON 对象：

   {
     "keyId": undefined,
     "secretId": undefined,
     "name": "YOUR-CERTIFICATE-NAME",
       "reuseKey": false,
       "keyCurveName": undefined,
       "exportable": true,
       "issuerName": 'Self',
       "certificateType": undefined,
       "certificateTransparency": undefined
     },
     "properties": {
       "createdOn": 2021-11-29T20:17:45.000Z,
       "updatedOn": 2021-11-29T20:17:45.000Z,
       "expiresOn": 2022-11-29T20:17:45.000Z,
       "id": "https://YOUR-KEY-VAULT-NAME.vault.azure.cn/certificates/YOUR-CERTIFICATE-NAME/YOUR-CERTIFICATE-VERSION",
       "enabled": false,
       "notBefore": 2021-11-29T20:07:45.000Z,
       "recoveryLevel": "Recoverable+Purgeable",
       "name": "YOUR-CERTIFICATE-NAME",
       "vaultUrl": "https://YOUR-KEY-VAULT-NAME.vault.azure.cn",
       "version": "YOUR-CERTIFICATE-VERSION",
       "tags": undefined,
       "x509Thumbprint": undefined,
       "recoverableDays": 90
     }
   }
   

• 创建新的文本文件，并将以下代码粘贴到 index.ts 文件中。

const { CertificateClient, DefaultCertificatePolicy } = require("@azure/keyvault-certificates");
const { DefaultAzureCredential } = require("@azure/identity");

async function main() {
  // If you're using MSI, DefaultAzureCredential should "just work".
  // Otherwise, DefaultAzureCredential expects the following three environment variables:
  // - AZURE_TENANT_ID: The tenant ID in Azure Active Directory
  // - AZURE_CLIENT_ID: The application (client) ID registered in the AAD tenant
  // - AZURE_CLIENT_SECRET: The client secret for the registered application
  const credential = new DefaultAzureCredential();

  const keyVaultUrl = process.env["KEY_VAULT_URL"];
  if(!keyVaultUrl) throw new Error("KEY_VAULT_URL is empty");

  const client = new CertificateClient(keyVaultUrl, credential);

  const uniqueString = new Date().getTime();
  const certificateName = `cert${uniqueString}`;

  // Creating a self-signed certificate
  const createPoller = await client.beginCreateCertificate(
    certificateName,
    DefaultCertificatePolicy
  );

  const pendingCertificate = createPoller.getResult();
  console.log("Certificate: ", pendingCertificate);

  // To read a certificate with their policy:
  let certificateWithPolicy = await client.getCertificate(certificateName);
  // Note: It will always read the latest version of the certificate.

  console.log("Certificate with policy:", certificateWithPolicy);

  // To read a certificate from a specific version:
  const certificateFromVersion = await client.getCertificateVersion(
    certificateName,
    certificateWithPolicy.properties.version
  );
  // Note: It will not retrieve the certificate's policy.
  console.log("Certificate from a specific version:", certificateFromVersion);

  const updatedCertificate = await client.updateCertificateProperties(certificateName, "", {
    tags: {
      customTag: "value"
    }
  });
  console.log("Updated certificate:", updatedCertificate);

  // Updating the certificate's policy:
  await client.updateCertificatePolicy(certificateName, {
    issuerName: "Self",
    subject: "cn=MyOtherCert"
  });
  certificateWithPolicy = await client.getCertificate(certificateName);
  console.log("updatedCertificate certificate's policy:", certificateWithPolicy.policy);

  // delete certificate
  const deletePoller = await client.beginDeleteCertificate(certificateName);
  const deletedCertificate = await deletePoller.pollUntilDone();
  console.log("Recovery Id: ", deletedCertificate.recoveryId);
  console.log("Deleted Date: ", deletedCertificate.deletedOn);
  console.log("Scheduled Purge Date: ", deletedCertificate.scheduledPurgeDate);
}

main().catch((error) => {
  console.error("An error occurred:", error);
  process.exit(1);
});

运行示例应用程序

1. 构建 TypeScript 应用：

   tsc
   

2. 运行应用：

   node index.js
   

3. create 和 get 方法为证书返回完整的 JSON 对象：

   {
     "keyId": undefined,
     "secretId": undefined,
     "name": "YOUR-CERTIFICATE-NAME",
       "reuseKey": false,
       "keyCurveName": undefined,
       "exportable": true,
       "issuerName": 'Self',
       "certificateType": undefined,
       "certificateTransparency": undefined
     },
     "properties": {
       "createdOn": 2021-11-29T20:17:45.000Z,
       "updatedOn": 2021-11-29T20:17:45.000Z,
       "expiresOn": 2022-11-29T20:17:45.000Z,
       "id": "https://YOUR-KEY-VAULT-NAME-ENDPOINT/certificates/YOUR-CERTIFICATE-NAME/YOUR-CERTIFICATE-VERSION",
       "enabled": false,
       "notBefore": 2021-11-29T20:07:45.000Z,
       "recoveryLevel": "Recoverable+Purgeable",
       "name": "YOUR-CERTIFICATE-NAME",
       "vaultUrl": "https://YOUR-KEY-VAULT-NAME-ENDPOINT",
       "version": "YOUR-CERTIFICATE-VERSION",
       "tags": undefined,
       "x509Thumbprint": undefined,
       "recoverableDays": 90
     }
   }