How to store Public Certiticate (.cer file) in Azure Key Vault

Question

How I can upload or store public key (.cer) file in azure keyvault. From the keyvault panel it gives error when I tried to to upload any .cer file where It works for .pfx file.

Answer 1

Loading Public Key Certificates

Azure Key Vault Explorer allows you to load public key certificates (.cer files).

Certificates are stored as keys in the Key Vault using a "standard" format used by that application (since .cer files aren't natively supported by Azure Key Vault).

Accessing Public Key Certificates

Once you have loaded public keys into the Azure Key Vault, they can then be accessed programatically as follows:

// load certificate based on format used by `Azure Key Vault Explorer`
var azureServiceTokenProvider = new AzureServiceTokenProvider();
var kv = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
var certBundle = await kv.GetSecretAsync(secretIdentifier).ConfigureAwait(false);

byte[] certBytes = null;
if (certBundle.ContentType == "application/x-pkcs12")
{
    certBytes = Convert.FromBase64String(certBundle.Value);
}
else if (certBundle.ContentType == "application/pkix-cert")
{
    certBytes = certBundle?.Value.FromJson<PublicKeyCertificate>()?.Data;
}
if (certBytes != null && certBytes.Length > 0)
{
    return new X509Certificate2(certBytes,
        "",
        X509KeyStorageFlags.Exportable |
        X509KeyStorageFlags.MachineKeySet |
        X509KeyStorageFlags.PersistKeySet);
}
return null;

...

// class used to access public key certificate stored in Key Vault
public class PublicKeyCertificate
{
    public byte[] Data;
}

Answer 2

You should consider if Key Vault is the appropriate solution for your scenario. The public key (by nature) is not confidential data, you don't need a secure place to store it. You can use a general purpose storage service for it.

If you still need to use Key Vault, you can store it as a secret. Key Vault secrets are octet sequences with a maximum size of 25k bytes each.