Accessing Azure Key Vaults Using Certification

Step 5. Register certificate in Local Machine

Open the private certification (.psk file) and follow the below steps to register the certificate on a local machine.

Select default options provide a private key and finish the wizard, this will register the certificate on a local machine. We can find the registered certificate in MMC (Microsoft Management Console).

Search for MMC and open.

Open the File menu and click on Add/Remove Snap-in. Select Computer Account and Local Computer to add the certificate section.

Open the Certificate folder. You can see all the registered certificates here.

Step 6. Creating an application to access the key vaults

Here, I am creating a simple Visual Studio console application for demo purposes.

Create a console application and add the below helper call to the project.

AzureKeyVaultCertificationHelper.cs

using Microsoft.Azure.KeyVault;
using Microsoft.IdentityModel.Clients.ActiveDirectory;
using System;
using System.Collections.Generic;
using System.Configuration;
using System.Linq;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading.Tasks;
namespace KeyVaultCertification
{
    public class AzureKeyVaultCertificationHelper
    {
        public static X509Certificate2 FindCertificateByThumbprint(string thumbprint)
        {
            X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
            try
            {
                store.Open(OpenFlags.ReadOnly);
                X509Certificate2Collection col = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
                if (col == null || col.Count == 0)
                {
                    throw new Exception("ERROR: Certificate not found with thumbprint");
                }
                return col[0];
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex.Message);
                return null;
            }
            finally
            {
                store.Close();
            }
        }
        public static ClientAssertionCertificate AssertionCert { get; set; }
        public static void GetCertification()
        {
            var clientAssertionCertPfx = FindCertificateByThumbprint(ConfigurationManager.AppSettings["ThumbPrint"]);
            AssertionCert = new ClientAssertionCertificate(ConfigurationManager.AppSettings["ClientApplicationId"], clientAssertionCertPfx);
        }
        public static async Task<string> GetAccessToken(string authority, string resource, string scope)
        {
            var context = new AuthenticationContext(authority, TokenCache.DefaultShared);
            var result = await context.AcquireTokenAsync(resource, AssertionCert);
            return result.AccessToken;
        }
        public static string GetKeyVaultSecret(string secretNode)
        {
            var secretUri = string.Format("{0}{1}", ConfigurationManager.AppSettings["VaultUrl"] + "/secrets/", secretNode);
            GetCertification();
            var keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(GetAccessToken));
            return keyVaultClient.GetSecretAsync(secretUri).Result.Value;
        }
    }
}

Program. cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
namespace KeyVaultCertification
{
    public class Program
    {
        static void Main(string[] args)
        {
            string sourceUrl = AzureKeyVaultCertificationHelper.GetKeyVaultSecret("SourceUrl");
            Console.WriteLine(sourceUrl);
        }
    }
}

Provide certificate Thumbprint, Azure AD App client ID, and Vault URL.

app. config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <startup>
    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.1"/>
  </startup>
  <appSettings>
    <add key="ThumbPrint" value="4444B4EDC4BFA4444444C44E4FF53B13B444C444"/>
    <add key="ClientApplicationId" value="abcdef-ghij-413e-klmn-1922ff69xyz"/>
    <add key="VaultUrl" value="https://RKkeyvault.azure.net"/>
  </appSettings>
</configuration>

Output