将 Azure SSL 证书导出为 pfx 文件 [英] Export Azure SSL certificate as pfx file

问题描述

我从 azure 购买了通配符证书.它现在位于 Key Vault 中.我需要将它上传到我们的另一台服务器，该服务器托管同一域的其他应用程序之一.在 azure 门户中的任何位置都没有将证书导出为 .pfx 文件的选项.

I purchased a wild card certificate from azure. It sits right now in the Key Vault. I need to upload it to our other server which hosts one of our other applications for the same domain. There is no option to export the certificate as a .pfx file anywhere in azure portal.

请帮忙.

推荐答案

您可以使用 PowerShell 创建 Azure 应用服务证书的本地 PFX 副本.

You can create a local PFX copy of Azure App Service Certificate using PowerShell.

从以下变量中提供适当的值并将脚本保存为 copyasc.ps1.

Provide appropriate values from the following variables and save the script as copyasc.ps1.

变量:

$appServiceCertificateName = "ascdemo"
$resourceGroupName = "ascdemorg"
$azureLoginEmailId = "[e-mail]"
$subscriptionId = "fb2c25dc-6bab-45c4-8cc9-cece7c42a95a"

copyasc.ps1:

copyasc.ps1:

$appServiceCertificateName = ""
$resourceGroupName = ""
$azureLoginEmailId = ""
$subscriptionId = ""

Login-AzureRmAccount
Set-AzureRmContext -SubscriptionId $subscriptionId

$ascResource = Get-AzureRmResource -ResourceName $appServiceCertificateName -ResourceGroupName $resourceGroupName -ResourceType "Microsoft.CertificateRegistration/certificateOrders" -ApiVersion "2015-08-01"
$keyVaultId = ""
$keyVaultSecretName = ""

$certificateProperties=Get-Member -InputObject $ascResource.Properties.certificates[0] -MemberType NoteProperty
$certificateName = $certificateProperties[0].Name
$keyVaultId = $ascResource.Properties.certificates[0].$certificateName.KeyVaultId
$keyVaultSecretName = $ascResource.Properties.certificates[0].$certificateName.KeyVaultSecretName

$keyVaultIdParts = $keyVaultId.Split("/")
$keyVaultName = $keyVaultIdParts[$keyVaultIdParts.Length - 1]
$keyVaultResourceGroupName = $keyVaultIdParts[$keyVaultIdParts.Length - 5]
Set-AzureRmKeyVaultAccessPolicy -ResourceGroupName $keyVaultResourceGroupName -VaultName $keyVaultName -UserPrincipalName $azureLoginEmailId -PermissionsToSecrets get
$secret = Get-AzureKeyVaultSecret -VaultName $keyVaultName -Name $keyVaultSecretName
$pfxCertObject=New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @([Convert]::FromBase64String($secret.SecretValueText),"", [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)
$pfxPassword = -join ((65..90) + (97..122) + (48..57) | Get-Random -Count 50 | % {[char]$_})
$currentDirectory = (Get-Location -PSProvider FileSystem).ProviderPath
[Environment]::CurrentDirectory = (Get-Location -PSProvider FileSystem).ProviderPath
[io.file]::WriteAllBytes(".appservicecertificate.pfx", $pfxCertObject.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12, $pfxPassword))
Write-Host "Created an App Service Certificate copy at: $currentDirectoryappservicecertificate.pfx"
Write-Warning "For security reasons, do not store the PFX password. Use it directly from the console as required."
Write-Host "PFX password: $pfxPassword"

在 PowerShell 控制台中键入以下命令以执行脚本:

Type the following commands in PowerShell console to execute the script:

Powershell –ExecutionPolicy Bypass
.copyasc.ps1

您可以在 Azure 应用服务团队博客中找到更多详细信息 创建应用服务证书的本地 PFX 副本

You can find more details on Azure App Service Team Blog Creating a local PFX copy of App Service Certificate

如果您有想要在 Azure 应用服务生态系统之外使用的应用服务证书，请尝试一下，让我们知道它是如何进行的.如果您遇到任何问题，请在 Stackoverflow 或 Azure 应用服务论坛.

If you have an App Service Certificate that you would like to use outside of Azure App Service ecosystem, then give this a try and let us know how it goes. If you run into any issues, please let us know on the Stackoverflow or on the Azure App Service forum.

这篇关于将 Azure SSL 证书导出为 pfx 文件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！