[FEATURE REQ] ClientCertificateCredential should support certificate store

Library name

Azure.Identity

Please describe the feature.

This is a feature request on behalf of @abatishchev.

In track 1 the AppAuthentication library supported loading authentication certificates from the certificate store directly by specifying either the thumbprint or subject name and issuer via its connection string. It also supported refreshing the certificate from the store in the SNI case to enable seamless certificate rolling.

In track 2 we have the ClientCertificateCredential which only supports a pre-loaded certificate, or loading a certificate from disk, and doesn’t support rolling the certificate. While we have some track 2 samples which demonstrate how an application might achieve this behavior, there are no built-in credential types which users can use out of the box.

Given that using of the certificate store, and automatic rolling of certificates are security best practices, it would be good to enable these behaviors directly in Azure.Identity, or possibly a plugin library, so that users aren’t left to implementing them in their applications.

[JaredShaver]

This request has been opened several times in multiple repositories so I don’t remember who suggested it, but an idea presented by another user was to use the PowerShell CertificateProvider syntax for the certificate path (ex. set AZURE_CLIENT_CERTIFICATE_STORE \LocalMachine\My\52A149D0393CE8A8D4AF0B172ED667A9E3A1F44E ). https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/about/about_certificate_provider?view=powershell-7.2 https://github.com/PowerShell/PowerShell/blob/b46ac16e09dce433dbc1ecb19ab949754eef4978/src/Microsoft.PowerShell.Security/security/CertificateProvider.cs#L1223

[iinuwa]

+1 for using the Cert:\ syntax for specifying certificates in the store. That could specified as an environment variable pretty easily.