[Azure/azure-sdk-for-java]: import certificate to keyvault by CertificateClient failed

Query/Question try to use keyvault to upload a customized certificate(cert.pem) failed.

Setup (please complete the following information if applicable):

• OS: win10
• IDE: IntelliJ
• Library/Libraries: com.azure:azure-security-keyvault-certificates:4.4.1

Information Checklist error:

Exception in thread "main" com.azure.core.exception.HttpResponseException: Status code 400, "{"error":{"code":"BadParameter","message":"No certificate with private key found in the specified X.509 certificate content. Please specify X.509 certificate content with only one certificate containing private key."}}"
	at com.azure.core.implementation.http.rest.RestProxyBase.instantiateUnexpectedException(RestProxyBase.java:348)
	at com.azure.core.implementation.http.rest.SyncRestProxy.ensureExpectedStatus(SyncRestProxy.java:126)
	at com.azure.core.implementation.http.rest.SyncRestProxy.handleRestReturnType(SyncRestProxy.java:209)
	at com.azure.core.implementation.http.rest.SyncRestProxy.invoke(SyncRestProxy.java:79)
	at com.azure.core.implementation.http.rest.RestProxyBase.invoke(RestProxyBase.java:94)
	at com.azure.core.http.rest.RestProxy.invoke(RestProxy.java:95)
	at com.sun.proxy.$Proxy3.importCertificate(Unknown Source)
	at com.azure.security.keyvault.certificates.implementation.CertificateClientImpl.importCertificateWithResponse(CertificateClientImpl.java:1869)
	at com.azure.security.keyvault.certificates.CertificateClient.importCertificateWithResponse(CertificateClient.java:1569)
	at com.azure.security.keyvault.certificates.CertificateClient.importCertificate(CertificateClient.java:1539)
	at org.hhu.key.vault.demo.App.main(App.java:48)

pom.xml:

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.azure</groupId>
            <artifactId>azure-sdk-bom</artifactId>
            <version>1.2.7</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>
<dependencies>
    <dependency>
        <groupId>com.azure</groupId>
        <artifactId>azure-security-keyvault-certificates</artifactId>
    </dependency>
    <dependency>
        <groupId>com.azure</groupId>
        <artifactId>azure-identity</artifactId>
    </dependency>
</dependencies>

customized certificate:

openssl req -newkey rsa:2048 -x509 -keyout key.pem -out cert.pem -days 365

code:

ClientSecretCredential clientSecretCredential = new ClientSecretCredentialBuilder()
        .authorityHost(authorityHost)
        .tenantId(tenantId)
        .clientId(clientId)
        .clientSecret(clientSecret)
        .build();

CertificateClient certificateClient = new CertificateClientBuilder()
        .credential(clientSecretCredential)
        .vaultUrl(url)
        .buildClient();

CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
Certificate certificate = certificateFactory.generateCertificate(Files.newInputStream(Paths.get("C:/chen/tmp/cert.pem")));
byte[] bytes = certificate.getEncoded();

ImportCertificateOptions importCertificateOptions = new ImportCertificateOptions("cert-test", bytes);
importCertificateOptions.setEnabled(true);
importCertificateOptions.setPassword("1234");

// ERROR
KeyVaultCertificateWithPolicy keyVaultCertificateWithPolicy = certificateClient.importCertificate(importCertificateOptions);

[joshfree]

@vcolin7 could you please follow up with @CQ-Developer on this github issue?

[vcolin7]

Hi @CQ-Developer, sorry for not getting back to you earlier, I was out for most of last week. Your use of a SecretClient sounds like an adequate approach, as the Key Vault service itself stores the private key of a certificate it creates as a secret, which in turn cannot be retrieved with as CertificateClient.