Azure Key Vault Certificates Client Library for Python

4.10.0 · active · verified Sat Apr 11

The Azure Key Vault Certificates client library for Python allows developers to manage X.509 certificates in Azure Key Vault. It provides capabilities to create, retrieve, update, and delete certificates, as well as manage certificate issuers, contacts, and policies. Azure Key Vault is a cloud service for securely storing and managing secrets, keys, and certificates. This library is part of the Azure SDK for Python and is currently at version 4.10.0, with active development and regular updates.

Common errors

Warnings

Install

Imports

Quickstart

This quickstart demonstrates how to authenticate with Azure Key Vault using `DefaultAzureCredential` and perform basic operations: creating a self-signed certificate, retrieving it, and then deleting it. Ensure you have an Azure subscription, an existing Azure Key Vault, and are logged into Azure CLI (`az login`) or have appropriate environment variables set for authentication. Replace 'YOUR_KEY_VAULT_NAME' or set the `AZURE_KEYVAULT_NAME` environment variable.

import os
from azure.keyvault.certificates import CertificateClient, CertificatePolicy
from azure.identity import DefaultAzureCredential

# Set your Key Vault name and certificate name as environment variables or replace directly.
# For local development, ensure you are logged in via Azure CLI (az login).
keyvault_name = os.environ.get('AZURE_KEYVAULT_NAME', 'YOUR_KEY_VAULT_NAME')
certificate_name = 'MySampleCertificate'

# Construct the Key Vault URL
vault_url = f"https://{keyvault_name}.vault.azure.net"

# Authenticate using DefaultAzureCredential
# This credential type is suitable for local development and managed identity in production.
credential = DefaultAzureCredential()

# Create a CertificateClient
certificate_client = CertificateClient(vault_url=vault_url, credential=credential)

async def manage_certificate():
    print(f"Creating a self-signed certificate '{certificate_name}' in {keyvault_name}...")
    # Create a certificate policy for a self-signed certificate
    policy = CertificatePolicy.create_self_signed(
        subject="CN=www.contoso.com",
        issuer_name="Self",
        validity_in_months=12
    )

    # Begin creating the certificate - this is a long-running operation
    poller = await certificate_client.begin_create_certificate(certificate_name, policy)
    
    # Wait for the certificate creation to complete
    created_certificate = await poller.result()
    print(f"Certificate '{created_certificate.name}' created with thumbprint: {created_certificate.properties.x509_thumbprint}")

    print(f"Retrieving certificate '{certificate_name}'...")
    retrieved_certificate = await certificate_client.get_certificate(certificate_name)
    print(f"Retrieved certificate version: {retrieved_certificate.properties.version}")

    print(f"Deleting certificate '{certificate_name}'...")
    # Begin deleting the certificate - this is a long-running operation
    delete_poller = await certificate_client.begin_delete_certificate(certificate_name)
    await delete_poller.wait()
    print(f"Certificate '{certificate_name}' deleted.")

    # Don't forget to close the credential and client when done (especially for async)
    await certificate_client.close()
    await credential.close()

# Example of how to run the async function
import asyncio
if __name__ == '__main__':
    # Make sure to set AZURE_KEYVAULT_NAME environment variable
    # e.g., export AZURE_KEYVAULT_NAME="my-unique-vault-name"
    # And login via Azure CLI: az login
    asyncio.run(manage_certificate())

view raw JSON →