Azure Keyvault Certificates Rust

作者 microsoft354361d83247MIT收录于 2026年10月8日更新于 2026年10月8日

Azure Key Vault Certificates library for Rust. Create, manage, and use X.509 certificates including self-signed and CA-issued. Triggers: "keyvault certificates rust", "CertificateClient rust", "create certificate rust", "self-signed certificate rust", "X.509 rust".

精选仅含说明Software Development Security

AI 生成的概览

指导 Rust 开发者使用 Azure Key Vault 证书 SDK 创建、管理和使用 X.509 证书。

功能: 提供 azure_security_keyvault_certificates crate 的 Rust 代码示例，涵盖客户端初始化、身份验证、以长时间运行操作方式创建证书、更新属性、删除以及分页列出证书。还展示如何通过 Key Vault Keys SDK 使用证书密钥进行签名，并介绍证书格式、RBAC 角色和最佳实践。产出为参考指引和代码片段，而非生成文件。
适用场景: 适用于编写在 Azure Key Vault 中创建或管理 X.509 证书的 Rust 代码，包括自签名或由 CA 签发的证书。也适用于处理证书签发的长时间运行操作或使用证书密钥对数据进行签名。
运行要求: 需要 Rust 工具链及 cargo，以及 azure_security_keyvault_certificates、azure_identity、tokio 和 futures 等 crate，可选 azure_core 与 azure_security_keyvault_keys。需要通过 AZURE_KEYVAULT_URL 环境变量提供 Azure Key Vault 地址，并具备 Azure 凭据（本地使用 DeveloperToolsCredential，生产环境使用 ManagedIdentityCredential），同时需要访问 Azure 的网络连接。不包含脚本，仅为说明文档。

Azure Key Vault Certificates library for Rust

Manage X.509 certificates for TLS/SSL, code signing, and authentication.

Use this skill when:

An app needs to create or manage X.509 certificates in Key Vault from Rust
You need self-signed or CA-issued certificates
You need long-running operations (LRO) for certificate issuance
You need to sign data using a certificate's key

IMPORTANT: Only use the official azure_security_keyvault_certificates crate published by the azure-sdk crates.io user. Do NOT use unofficial or community crates. Official crates use underscores in names and none have version 0.21.0.

Installation

If your code uses azure_core types directly, add azure_core to Cargo.toml. If you only use azure_security_keyvault_certificates re-exports, direct azure_core dependency is optional.

Environment Variables

Authentication

Rust Azure SDK code must not use DefaultAzureCredential. The Rust identity crate does not provide that type.

rust

use azure_identity::DeveloperToolsCredential;use azure_security_keyvault_certificates::CertificateClient;
#[tokio::main]async fn main() -> Result<(), Box<dyn std::error::Error>> {    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.    let credential = DeveloperToolsCredential::new(None)?;    let client = CertificateClient::new(        "https://<vault-name>.vault.azure.net/",        credential.clone(),        None,    )?;
    let cert = client        .get_certificate("cert-name", None)        .await?        .into_model()?;    println!("Certificate: {:?}", cert.id);    Ok(())}

use azure_identity::DeveloperToolsCredential;use azure_security_keyvault_certificates::CertificateClient;
#[tokio::main]async fn main() -> Result<(), Box<dyn std::error::Error>> {    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.    let credential = DeveloperToolsCredential::new(None)?;    let client = CertificateClient::new(        "https://<vault-name>.vault.azure.net/",        credential.clone(),        None,    )?;
    let cert = client        .get_certificate("cert-name", None)        .await?        .into_model()?;    println!("Certificate: {:?}", cert.id);    Ok(())}

Prefer the crate README/examples when checking LRO and poller usage rather than inferring public behavior from generated internal types.

Core Workflow

Create Self-Signed Certificate (LRO)

Creating a certificate is a long-running operation. Poller<T> implements IntoFuture — just .await:

rust

use azure_security_keyvault_certificates::{    models::{        CertificatePolicy, CreateCertificateParameters, IssuerParameters,        X509CertificateProperties,    },    ResourceExt,};
let policy = CertificatePolicy {    x509_certificate_properties: Some(X509CertificateProperties {        subject: Some("CN=example.com".into()),        ..Default::default()    }),    issuer_parameters: Some(IssuerParameters {        name: Some("Self".into()),        ..Default::default()    }),    ..Default::default()};let body = CreateCertificateParameters {    certificate_policy: Some(policy),    ..Default::default()};
// Poller implements IntoFuture — await directly for completionlet cert = client    .begin_create_certificate("cert-name", body.try_into()?, None)?    .await?    .into_model()?;
println!(    "Name: {:?}, Version: {:?}",    cert.resource_id()?.name,    cert.resource_id()?.version,);

use azure_security_keyvault_certificates::{    models::{        CertificatePolicy, CreateCertificateParameters, IssuerParameters,        X509CertificateProperties,    },    ResourceExt,};
let policy = CertificatePolicy {    x509_certificate_properties: Some(X509CertificateProperties {        subject: Some("CN=example.com".into()),        ..Default::default()    }),    issuer_parameters: Some(IssuerParameters {        name: Some("Self".into()),        ..Default::default()    }),    ..Default::default()};let body = CreateCertificateParameters {    certificate_policy: Some(policy),    ..Default::default()};
// Poller implements IntoFuture — await directly for completionlet cert = client    .begin_create_certificate("cert-name", body.try_into()?, None)?    .await?    .into_model()?;
println!(    "Name: {:?}, Version: {:?}",    cert.resource_id()?.name,    cert.resource_id()?.version,);

Update Certificate Properties

rust

use azure_security_keyvault_certificates::models::UpdateCertificatePropertiesParameters;use std::collections::HashMap;
#[allow(clippy::needless_update)]let params = UpdateCertificatePropertiesParameters {    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),    ..Default::default()};
client    .update_certificate_properties("cert-name", params.try_into()?, None)    .await?    .into_model()?;

use azure_security_keyvault_certificates::models::UpdateCertificatePropertiesParameters;use std::collections::HashMap;
#[allow(clippy::needless_update)]let params = UpdateCertificatePropertiesParameters {    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),    ..Default::default()};
client    .update_certificate_properties("cert-name", params.try_into()?, None)    .await?    .into_model()?;

Delete Certificate

List Certificates (Pagination)

list_certificate_properties returns a Pager<T> — iterate items directly:

rust

use azure_security_keyvault_certificates::ResourceExt;use futures::TryStreamExt as _;
let mut pager = client.list_certificate_properties(None)?;while let Some(cert) = pager.try_next().await? {    println!("Found: {}", cert.resource_id()?.name);}

use azure_security_keyvault_certificates::ResourceExt;use futures::TryStreamExt as _;
let mut pager = client.list_certificate_properties(None)?;while let Some(cert) = pager.try_next().await? {    println!("Found: {}", cert.resource_id()?.name);}

Signing with a Certificate's Key

Certificates in Key Vault have an associated key. Use the Key Vault Keys SDK for crypto operations:

rust

use azure_security_keyvault_keys::{    models::{KeyClientSignOptions, SignParameters, SignatureAlgorithm},    KeyClient,};
let key_client = KeyClient::new(    "https://<vault-name>.vault.azure.net/",    credential.clone(),    None,)?;
// Sign with the certificate's EC keylet digest = vec![0u8; 32]; // SHA-256 digestlet body = SignParameters {    algorithm: Some(SignatureAlgorithm::Es256),    value: Some(digest),};
let result = key_client    .sign(        "cert-name",        body.try_into()?,        Some(KeyClientSignOptions {            key_version: Some("<certificate-version>".to_string()),            ..Default::default()        }),    )    .await?    .into_model()?;println!("Signature: {:?}", result.result);

use azure_security_keyvault_keys::{    models::{KeyClientSignOptions, SignParameters, SignatureAlgorithm},    KeyClient,};
let key_client = KeyClient::new(    "https://<vault-name>.vault.azure.net/",    credential.clone(),    None,)?;
// Sign with the certificate's EC keylet digest = vec![0u8; 32]; // SHA-256 digestlet body = SignParameters {    algorithm: Some(SignatureAlgorithm::Es256),    value: Some(digest),};
let result = key_client    .sign(        "cert-name",        body.try_into()?,        Some(KeyClientSignOptions {            key_version: Some("<certificate-version>".to_string()),            ..Default::default()        }),    )    .await?    .into_model()?;println!("Signature: {:?}", result.result);

Certificate Formats

RBAC Roles

For Entra ID auth, assign one of these roles:

Best Practices

Use cargo add to manage dependencies, never edit Cargo.toml directly. Add and remove Rust SDK dependencies with cargo commands instead of manual manifest edits.
Add azure_core only when importing azure_core types directly. If your code imports azure_core::http::Url, azure_core::http::RequestContent, or azure_core::error::ErrorKind, include azure_core; otherwise a direct dependency is optional.
Use DeveloperToolsCredential for local dev, ManagedIdentityCredential for production — Rust does not provide a single DefaultAzureCredential type
Never hardcode credentials — use environment variables or managed identity
Use ..Default::default() with #[allow(clippy::needless_update)] for model struct updates
Use ResourceExt to extract certificate name/version from IDs
LROs — begin_create_certificate returns a Poller; just .await for completion (clients should rarely poll for status)
Reuse clients — CertificateClient is thread-safe; create once, share across tasks
Run cargo clippy -- -D warnings when the prompt, eval, or CI expects lint-clean output

Reference Links

Resource	Link
API Reference	https://docs.rs/azure_security_keyvault_certificates/latest/azure_security_keyvault_certificates
crates.io	https://crates.io/crates/azure_security_keyvault_certificates
Source Code	https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_certificates

来源与署名

来源：microsoft/skills位于.github/plugins/azure-sdk-rust/skills/azure-keyvault-certificates-rust提交354361d

许可证： MIT

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Format	Content Type	Use Case
PKCS#12	`application/x-pkcs12`	Bundled cert + private key
PEM	`application/x-pem-file`	Base64-encoded, common in Linux/web

Role	Access
`Key Vault Certificate User`	Use certificates
`Key Vault Certificates Officer`	Full certificate management

Azure Keyvault Certificates Rust

Azure Key Vault Certificates library for Rust

Installation

Environment Variables

Authentication

Core Workflow

Create Self-Signed Certificate (LRO)

Update Certificate Properties

Delete Certificate

List Certificates (Pagination)

Signing with a Certificate's Key

Certificate Formats

RBAC Roles

Best Practices

Reference Links

来源与署名

更多来自 microsoft/skills 的技能

Customize

Discover Azure Skills

Azure Resource Visualizer

Azure Resource Lookup

Azure Messaging

Azure Kusto

更多Software Development技能

Playground

M5 Onboard

Cardputer Buddy

Dpop Adoption

Gemini Live Api

Gemini Api