如何从密钥库中检索证书并将其导入到另一个证书中而不保存它？

Question

在Azure管道中，有以下任务

1. [AzureResourceManagerTemplateDeployment @ 3从ARM模板部署密钥库
2. 然后，AzurePowerShell @ 5检查密钥保管库是否包含“我自己签名的证书”，如果不包含-将其导入密钥保管库
3. 最后，另一个AzureResourceManagerTemplateDeployment @ 3部署Service Fabric群集，并将SF群集及其VMSS配置为使用证书

以下是任务：

- task: AzureResourceManagerTemplateDeployment@3
  displayName: 'Deploy Keyvault'
  inputs:
    deploymentScope: 'Resource Group'
    subscriptionId: '${{ parameters.SubscriptionId }}'
    azureResourceManagerConnection: '${{ parameters.ArmConnection }}'
    action: 'Create Or Update Resource Group'
    resourceGroupName: '${{ parameters.resourceGroupName }}'
    location: 'West Europe'
    templateLocation: 'Linked artifact'
    csmFile: '$(Build.SourcesDirectory)/pipelines/templates/keyvault.json'
    csmParametersFile: '$(Build.SourcesDirectory)/pipelines/templates/keyvault-params.json'
    deploymentMode: 'Incremental'

- task: ARM Outputs@5
  displayName: 'Collect Keyvault output'
  inputs:
    ConnectedServiceNameSelector: 'ConnectedServiceNameARM'
    ConnectedServiceNameARM: '${{ parameters.ArmConnection }}'
    resourceGroupName: '${{ parameters.resourceGroupName }}'
    whenLastDeploymentIsFailed: 'fail'

- task: AzurePowerShell@5
  displayName: 'Import certificate'
  inputs:
    azureSubscription: '${{ parameters.ArmConnection }}'
    ScriptType: 'InlineScript'
    azurePowerShellVersion: '3.1.0'
    Inline: |
      $Cert = Get-AzKeyVaultCertificate -VaultName my-kv -Name my-self-signed-cert
      if (!$Cert) {
          $Base64 = 'MIIWMgIBA___3000_chars_here____o7WqDoWm5I7fg=='
          $Cert = Import-AzKeyVaultCertificate -VaultName my-kv -Name my-self-signed-cert -CertificateString $Base64
      }
      # set the pipeline variables Thumbprint and SecretId - needed for SF deployment
      echo "##vso[task.setvariable variable=Thumbprint]$($Cert.Thumbprint)"
      echo "##vso[task.setvariable variable=SecretId]$($Cert.SecretId)"

# deploy SF cluster by ARM template and use the SF Cluster certificate thumbsprint as admin cert
- task: AzureResourceManagerTemplateDeployment@3
  displayName: 'Deploy SF cluster'
  inputs:
    deploymentScope: 'Resource Group'
    subscriptionId: '${{ parameters.SubscriptionId }}'
    azureResourceManagerConnection: '${{ parameters.ArmConnection }}'
    action: 'Create Or Update Resource Group'
    resourceGroupName: '${{ parameters.resourceGroupName }}'
    location: 'West Europe'
    templateLocation: 'Linked artifact'
    csmFile: '$(Build.SourcesDirectory)/pipelines/templates/sfcluster.json'
    csmParametersFile: '$(Build.SourcesDirectory)/pipelines/templates/sfcluster-params.json'
    overrideParameters: '-certificateThumbprint $(Thumbprint) -sourceVaultResourceId $(KeyvaultId) -certificateUrlValue $(SecretId)'
    deploymentMode: 'Incremental'

这很好，但是现在我试图用托管在另一个Key Vault上的真实证书替换自签名证书。

[我的计划是从另一个Key Vault下载新的证书内容（包括密钥），然后对其进行Base64编码（以避免创建任何临时文件）-最后将Import-AzKeyVaultCertificate ... -CertificateString $Base64导入我的Key Vault（请参见“步骤2“（在我的任务列表中）。

我的问题是我被困在检索证书内容中。

我能够使用以下PowerShell命令检索“真实”证书：

$Cert = Get-AzKeyVaultCertificate -VaultName the-company-kv -Name the-real-cert
$Secret = Get-AzKeyVaultSecret -VaultName the-company-kv -Name the-real-cert

上面的命令返回一些元数据，但是没有什么类似于我将能够得到的内容（如果尚未进行base64编码）：

$Base64 = [System.Convert]::ToBase64String($Bytes)
Import-AzKeyVaultCertificate -VaultName my-kv -Name my-self-signed-cert -CertificateString $Base64

Answer 1

$Cert = Get-AzKeyVaultCertificate -VaultName my-kv -Name the-real-cert
if (!$Cert) {
    $OrigCert = Get-AzKeyVaultCertificate -VaultName the-company-kv -Name the-real-cert
    $Secret = Get-AzKeyVaultSecret -VaultName the-company-kv -Name $OrigCert.Name
    $Cert = Import-AzKeyVaultCertificate -VaultName my-kv -Name $OrigCert.Name -CertificateString $Secret.SecretValueText
}

[我没有意识到，当我在命令提示符下输入$Secret时，PowerShell并没有显示所有属性，因此我最初没有看到$Secret.SecretValueText。