Azure Keyvault Certificates Rust

作者 microsoft354361d83247MIT收錄於 2026年10月8日更新於 2026年10月8日

Azure Key Vault Certificates library for Rust. Create, manage, and use X.509 certificates including self-signed and CA-issued. Triggers: "keyvault certificates rust", "CertificateClient rust", "create certificate rust", "self-signed certificate rust", "X.509 rust".

精選僅含說明Software Development Security

AI 產生的概覽

指導 Rust 開發者使用 Azure Key Vault 憑證 SDK 建立、管理及使用 X.509 憑證。

功能: 提供 azure_security_keyvault_certificates crate 的 Rust 程式碼範例，涵蓋用戶端初始化、驗證、以長時間執行作業方式建立憑證、更新屬性、刪除以及分頁列出憑證。也示範如何透過 Key Vault Keys SDK 使用憑證金鑰進行簽章，並說明憑證格式、RBAC 角色與最佳實務。產出為參考指引與程式碼片段，而非產生的檔案。
適用情境: 適用於撰寫在 Azure Key Vault 中建立或管理 X.509 憑證的 Rust 程式碼，包括自簽或由 CA 簽發的憑證。也適用於處理憑證簽發的長時間執行作業，或使用憑證金鑰對資料簽章。
執行需求: 需要 Rust 工具鏈與 cargo，以及 azure_security_keyvault_certificates、azure_identity、tokio 和 futures 等 crate，可選用 azure_core 與 azure_security_keyvault_keys。需透過 AZURE_KEYVAULT_URL 環境變數提供 Azure Key Vault 網址，並具備 Azure 認證（本機使用 DeveloperToolsCredential，正式環境使用 ManagedIdentityCredential），同時需要連線至 Azure 的網路存取。不含指令碼，僅為說明文件。

Azure Key Vault Certificates library for Rust

Manage X.509 certificates for TLS/SSL, code signing, and authentication.

Use this skill when:

An app needs to create or manage X.509 certificates in Key Vault from Rust
You need self-signed or CA-issued certificates
You need long-running operations (LRO) for certificate issuance
You need to sign data using a certificate's key

IMPORTANT: Only use the official azure_security_keyvault_certificates crate published by the azure-sdk crates.io user. Do NOT use unofficial or community crates. Official crates use underscores in names and none have version 0.21.0.

Installation

If your code uses azure_core types directly, add azure_core to Cargo.toml. If you only use azure_security_keyvault_certificates re-exports, direct azure_core dependency is optional.

Environment Variables

Authentication

Rust Azure SDK code must not use DefaultAzureCredential. The Rust identity crate does not provide that type.

rust

use azure_identity::DeveloperToolsCredential;use azure_security_keyvault_certificates::CertificateClient;
#[tokio::main]async fn main() -> Result<(), Box<dyn std::error::Error>> {    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.    let credential = DeveloperToolsCredential::new(None)?;    let client = CertificateClient::new(        "https://<vault-name>.vault.azure.net/",        credential.clone(),        None,    )?;
    let cert = client        .get_certificate("cert-name", None)        .await?        .into_model()?;    println!("Certificate: {:?}", cert.id);    Ok(())}

use azure_identity::DeveloperToolsCredential;use azure_security_keyvault_certificates::CertificateClient;
#[tokio::main]async fn main() -> Result<(), Box<dyn std::error::Error>> {    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.    let credential = DeveloperToolsCredential::new(None)?;    let client = CertificateClient::new(        "https://<vault-name>.vault.azure.net/",        credential.clone(),        None,    )?;
    let cert = client        .get_certificate("cert-name", None)        .await?        .into_model()?;    println!("Certificate: {:?}", cert.id);    Ok(())}

Prefer the crate README/examples when checking LRO and poller usage rather than inferring public behavior from generated internal types.

Core Workflow

Create Self-Signed Certificate (LRO)

Creating a certificate is a long-running operation. Poller<T> implements IntoFuture — just .await:

rust

use azure_security_keyvault_certificates::{    models::{        CertificatePolicy, CreateCertificateParameters, IssuerParameters,        X509CertificateProperties,    },    ResourceExt,};
let policy = CertificatePolicy {    x509_certificate_properties: Some(X509CertificateProperties {        subject: Some("CN=example.com".into()),        ..Default::default()    }),    issuer_parameters: Some(IssuerParameters {        name: Some("Self".into()),        ..Default::default()    }),    ..Default::default()};let body = CreateCertificateParameters {    certificate_policy: Some(policy),    ..Default::default()};
// Poller implements IntoFuture — await directly for completionlet cert = client    .begin_create_certificate("cert-name", body.try_into()?, None)?    .await?    .into_model()?;
println!(    "Name: {:?}, Version: {:?}",    cert.resource_id()?.name,    cert.resource_id()?.version,);

use azure_security_keyvault_certificates::{    models::{        CertificatePolicy, CreateCertificateParameters, IssuerParameters,        X509CertificateProperties,    },    ResourceExt,};
let policy = CertificatePolicy {    x509_certificate_properties: Some(X509CertificateProperties {        subject: Some("CN=example.com".into()),        ..Default::default()    }),    issuer_parameters: Some(IssuerParameters {        name: Some("Self".into()),        ..Default::default()    }),    ..Default::default()};let body = CreateCertificateParameters {    certificate_policy: Some(policy),    ..Default::default()};
// Poller implements IntoFuture — await directly for completionlet cert = client    .begin_create_certificate("cert-name", body.try_into()?, None)?    .await?    .into_model()?;
println!(    "Name: {:?}, Version: {:?}",    cert.resource_id()?.name,    cert.resource_id()?.version,);

Update Certificate Properties

rust

use azure_security_keyvault_certificates::models::UpdateCertificatePropertiesParameters;use std::collections::HashMap;
#[allow(clippy::needless_update)]let params = UpdateCertificatePropertiesParameters {    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),    ..Default::default()};
client    .update_certificate_properties("cert-name", params.try_into()?, None)    .await?    .into_model()?;

use azure_security_keyvault_certificates::models::UpdateCertificatePropertiesParameters;use std::collections::HashMap;
#[allow(clippy::needless_update)]let params = UpdateCertificatePropertiesParameters {    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),    ..Default::default()};
client    .update_certificate_properties("cert-name", params.try_into()?, None)    .await?    .into_model()?;

Delete Certificate

List Certificates (Pagination)

list_certificate_properties returns a Pager<T> — iterate items directly:

rust

use azure_security_keyvault_certificates::ResourceExt;use futures::TryStreamExt as _;
let mut pager = client.list_certificate_properties(None)?;while let Some(cert) = pager.try_next().await? {    println!("Found: {}", cert.resource_id()?.name);}

use azure_security_keyvault_certificates::ResourceExt;use futures::TryStreamExt as _;
let mut pager = client.list_certificate_properties(None)?;while let Some(cert) = pager.try_next().await? {    println!("Found: {}", cert.resource_id()?.name);}

Signing with a Certificate's Key

Certificates in Key Vault have an associated key. Use the Key Vault Keys SDK for crypto operations:

rust

use azure_security_keyvault_keys::{    models::{KeyClientSignOptions, SignParameters, SignatureAlgorithm},    KeyClient,};
let key_client = KeyClient::new(    "https://<vault-name>.vault.azure.net/",    credential.clone(),    None,)?;
// Sign with the certificate's EC keylet digest = vec![0u8; 32]; // SHA-256 digestlet body = SignParameters {    algorithm: Some(SignatureAlgorithm::Es256),    value: Some(digest),};
let result = key_client    .sign(        "cert-name",        body.try_into()?,        Some(KeyClientSignOptions {            key_version: Some("<certificate-version>".to_string()),            ..Default::default()        }),    )    .await?    .into_model()?;println!("Signature: {:?}", result.result);

use azure_security_keyvault_keys::{    models::{KeyClientSignOptions, SignParameters, SignatureAlgorithm},    KeyClient,};
let key_client = KeyClient::new(    "https://<vault-name>.vault.azure.net/",    credential.clone(),    None,)?;
// Sign with the certificate's EC keylet digest = vec![0u8; 32]; // SHA-256 digestlet body = SignParameters {    algorithm: Some(SignatureAlgorithm::Es256),    value: Some(digest),};
let result = key_client    .sign(        "cert-name",        body.try_into()?,        Some(KeyClientSignOptions {            key_version: Some("<certificate-version>".to_string()),            ..Default::default()        }),    )    .await?    .into_model()?;println!("Signature: {:?}", result.result);

Certificate Formats

RBAC Roles

For Entra ID auth, assign one of these roles:

Best Practices

Use cargo add to manage dependencies, never edit Cargo.toml directly. Add and remove Rust SDK dependencies with cargo commands instead of manual manifest edits.
Add azure_core only when importing azure_core types directly. If your code imports azure_core::http::Url, azure_core::http::RequestContent, or azure_core::error::ErrorKind, include azure_core; otherwise a direct dependency is optional.
Use DeveloperToolsCredential for local dev, ManagedIdentityCredential for production — Rust does not provide a single DefaultAzureCredential type
Never hardcode credentials — use environment variables or managed identity
Use ..Default::default() with #[allow(clippy::needless_update)] for model struct updates
Use ResourceExt to extract certificate name/version from IDs
LROs — begin_create_certificate returns a Poller; just .await for completion (clients should rarely poll for status)
Reuse clients — CertificateClient is thread-safe; create once, share across tasks
Run cargo clippy -- -D warnings when the prompt, eval, or CI expects lint-clean output

Reference Links

Resource	Link
API Reference	https://docs.rs/azure_security_keyvault_certificates/latest/azure_security_keyvault_certificates
crates.io	https://crates.io/crates/azure_security_keyvault_certificates
Source Code	https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_certificates

來源與署名

來源：microsoft/skills位於.github/plugins/azure-sdk-rust/skills/azure-keyvault-certificates-rust提交354361d

授權條款： MIT

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

Format	Content Type	Use Case
PKCS#12	`application/x-pkcs12`	Bundled cert + private key
PEM	`application/x-pem-file`	Base64-encoded, common in Linux/web

Role	Access
`Key Vault Certificate User`	Use certificates
`Key Vault Certificates Officer`	Full certificate management

Azure Keyvault Certificates Rust

Azure Key Vault Certificates library for Rust

Installation

Environment Variables

Authentication

Core Workflow

Create Self-Signed Certificate (LRO)

Update Certificate Properties

Delete Certificate

List Certificates (Pagination)

Signing with a Certificate's Key

Certificate Formats

RBAC Roles

Best Practices

Reference Links

來源與署名

更多來自 microsoft/skills 的技能

Customize

Discover Azure Skills

Azure Resource Visualizer

Azure Resource Lookup

Azure Messaging

Azure Kusto

更多Software Development技能

Playground

M5 Onboard

Cardputer Buddy

Dpop Adoption

Gemini Live Api

Gemini Api