[BUG] KeyVault certificate download fails using latest SDK

Describe the bug I’m trying to download a PFX certificate, including the private key, from KeyVault using the new DownloadCertificateAsync method from the 4.2.0 version of the Azure.Security.KeyVault.Certificates package.

I’ve ensured the calling code has read access to both the certificate and the secrets in KeyVault. Unfortunately calling this method to obtain an X509Certificate2 fails with a WindowsCryptographicException.

I’ve done everything I can think of to confirm this isn’t an obvious error on my part, but since the API is new, maybe there are still some bugs or edge cases.

Expected behavior The file is downloaded as an X509Certificate, including the private key.

Actual behavior (include Exception or Stack Trace) An exception is thrown:

Result: Failure Exception: System.AggregateException: One or more errors occurred.
(The system cannot find the file specified.) ---> Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: 
The system cannot find the file specified. at Internal.Cryptography.Pal.CertificatePal.FilterPFXStore(ReadOnlySpan`1 rawData, SafePasswordHandle password, PfxCertStoreFlags pfxCertStoreFlags) at 
Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(ReadOnlySpan`1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags) at 
System.Security.Cryptography.X509Certificates.X509Certificate..ctor(ReadOnlySpan`1 data) at 
System.Security.Cryptography.X509Certificates.X509Certificate2..ctor(Byte[] rawData) at 
Azure.Security.KeyVault.Certificates.CertificateClient.DownloadCertificateAsync(String certificateName, String version, 
CancellationToken cancellationToken)

To Reproduce

1. Store a certificate with an exportable key in KeyVault
2. Configure permissions for GET for both certificates and secrets
3. Attempt to download the certificate with var certificate = await certificateClient.DownloadCertificateAsync("mycert");

Environment:

• Azure.Security.KeyVault.Certificates 4.2.0
• .NET 5.0
• Azure Functions running in Azure on private App Service Plan.

[juna-gupta]

@heaths I think X509KeyStorageFlags should be set to EphemeralKeySet | MachineKeySet in the SDK as these certificates are not persisted on disk.

Identity.Web library does that :

LoadFromKeyVault Setting default flags

[BrianVallelunga]

@heaths Thanks for the update.