Docs Home
We recommend using Azure Native.
Azure v6.22.1 published on Monday, May 12, 2025 by Pulumi
azure.keyvault.Certificate
Explore with Pulumi AI
Manages a Key Vault Certificate.
Example Usage
Importing A PFX)
Note: this example assumed the PFX file is located in the same directory at
certificate-to-import.pfx.
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
import * as std from "@pulumi/std";
const current = azure.core.getClientConfig({});
const example = new azure.core.ResourceGroup("example", {
name: "example-resources",
location: "West Europe",
});
const exampleKeyVault = new azure.keyvault.KeyVault("example", {
name: "examplekeyvault",
location: example.location,
resourceGroupName: example.name,
tenantId: current.then(current => current.tenantId),
skuName: "premium",
accessPolicies: [{
tenantId: current.then(current => current.tenantId),
objectId: current.then(current => current.objectId),
certificatePermissions: [
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"SetIssuers",
"Update",
],
keyPermissions: [
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
],
secretPermissions: [
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
],
}],
});
const exampleCertificate = new azure.keyvault.Certificate("example", {
name: "imported-cert",
keyVaultId: exampleKeyVault.id,
certificate: {
contents: std.filebase64({
input: "certificate-to-import.pfx",
}).then(invoke => invoke.result),
password: "",
},
});
import pulumi
import pulumi_azure as azure
import pulumi_std as std
current = azure.core.get_client_config()
example = azure.core.ResourceGroup("example",
name="example-resources",
location="West Europe")
example_key_vault = azure.keyvault.KeyVault("example",
name="examplekeyvault",
location=example.location,
resource_group_name=example.name,
tenant_id=current.tenant_id,
sku_name="premium",
access_policies=[{
"tenant_id": current.tenant_id,
"object_id": current.object_id,
"certificate_permissions": [
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"SetIssuers",
"Update",
],
"key_permissions": [
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
],
"secret_permissions": [
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
],
}])
example_certificate = azure.keyvault.Certificate("example",
name="imported-cert",
key_vault_id=example_key_vault.id,
certificate={
"contents": std.filebase64(input="certificate-to-import.pfx").result,
"password": "",
})
package main
import (
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/keyvault"
"github.com/pulumi/pulumi-std/sdk/go/std"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
current, err := core.GetClientConfig(ctx, map[string]interface{}{}, nil)
if err != nil {
return err
}
example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
Name: pulumi.String("example-resources"),
Location: pulumi.String("West Europe"),
})
if err != nil {
return err
}
exampleKeyVault, err := keyvault.NewKeyVault(ctx, "example", &keyvault.KeyVaultArgs{
Name: pulumi.String("examplekeyvault"),
Location: example.Location,
ResourceGroupName: example.Name,
TenantId: pulumi.String(current.TenantId),
SkuName: pulumi.String("premium"),
AccessPolicies: keyvault.KeyVaultAccessPolicyArray{
&keyvault.KeyVaultAccessPolicyArgs{
TenantId: pulumi.String(current.TenantId),
ObjectId: pulumi.String(current.ObjectId),
CertificatePermissions: pulumi.StringArray{
pulumi.String("Create"),
pulumi.String("Delete"),
pulumi.String("DeleteIssuers"),
pulumi.String("Get"),
pulumi.String("GetIssuers"),
pulumi.String("Import"),
pulumi.String("List"),
pulumi.String("ListIssuers"),
pulumi.String("ManageContacts"),
pulumi.String("ManageIssuers"),
pulumi.String("SetIssuers"),
pulumi.String("Update"),
},
KeyPermissions: pulumi.StringArray{
pulumi.String("Backup"),
pulumi.String("Create"),
pulumi.String("Decrypt"),
pulumi.String("Delete"),
pulumi.String("Encrypt"),
pulumi.String("Get"),
pulumi.String("Import"),
pulumi.String("List"),
pulumi.String("Purge"),
pulumi.String("Recover"),
pulumi.String("Restore"),
pulumi.String("Sign"),
pulumi.String("UnwrapKey"),
pulumi.String("Update"),
pulumi.String("Verify"),
pulumi.String("WrapKey"),
},
SecretPermissions: pulumi.StringArray{
pulumi.String("Backup"),
pulumi.String("Delete"),
pulumi.String("Get"),
pulumi.String("List"),
pulumi.String("Purge"),
pulumi.String("Recover"),
pulumi.String("Restore"),
pulumi.String("Set"),
},
},
},
})
if err != nil {
return err
}
invokeFilebase64, err := std.Filebase64(ctx, &std.Filebase64Args{
Input: "certificate-to-import.pfx",
}, nil)
if err != nil {
return err
}
_, err = keyvault.NewCertificate(ctx, "example", &keyvault.CertificateArgs{
Name: pulumi.String("imported-cert"),
KeyVaultId: exampleKeyVault.ID(),
Certificate: &keyvault.CertificateCertificateArgs{
Contents: pulumi.String(invokeFilebase64.Result),
Password: pulumi.String(""),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
using Std = Pulumi.Std;
return await Deployment.RunAsync(() =>
{
var current = Azure.Core.GetClientConfig.Invoke();
var example = new Azure.Core.ResourceGroup("example", new()
{
Name = "example-resources",
Location = "West Europe",
});
var exampleKeyVault = new Azure.KeyVault.KeyVault("example", new()
{
Name = "examplekeyvault",
Location = example.Location,
ResourceGroupName = example.Name,
TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
SkuName = "premium",
AccessPolicies = new[]
{
new Azure.KeyVault.Inputs.KeyVaultAccessPolicyArgs
{
TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
ObjectId = current.Apply(getClientConfigResult => getClientConfigResult.ObjectId),
CertificatePermissions = new[]
{
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"SetIssuers",
"Update",
},
KeyPermissions = new[]
{
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
},
SecretPermissions = new[]
{
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
},
},
},
});
var exampleCertificate = new Azure.KeyVault.Certificate("example", new()
{
Name = "imported-cert",
KeyVaultId = exampleKeyVault.Id,
KeyVaultCertificate = new Azure.KeyVault.Inputs.CertificateCertificateArgs
{
Contents = Std.Filebase64.Invoke(new()
{
Input = "certificate-to-import.pfx",
}).Apply(invoke => invoke.Result),
Password = "",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Certificate;
import com.pulumi.azure.keyvault.CertificateArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificateArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Filebase64Args;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var current = CoreFunctions.getClientConfig(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference);
var example = new ResourceGroup("example", ResourceGroupArgs.builder()
.name("example-resources")
.location("West Europe")
.build());
var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
.name("examplekeyvault")
.location(example.location())
.resourceGroupName(example.name())
.tenantId(current.tenantId())
.skuName("premium")
.accessPolicies(KeyVaultAccessPolicyArgs.builder()
.tenantId(current.tenantId())
.objectId(current.objectId())
.certificatePermissions(
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"SetIssuers",
"Update")
.keyPermissions(
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey")
.secretPermissions(
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set")
.build())
.build());
var exampleCertificate = new Certificate("exampleCertificate", CertificateArgs.builder()
.name("imported-cert")
.keyVaultId(exampleKeyVault.id())
.certificate(CertificateCertificateArgs.builder()
.contents(StdFunctions.filebase64(Filebase64Args.builder()
.input("certificate-to-import.pfx")
.build()).result())
.password("")
.build())
.build());
}
}
resources:
example:
type: azure:core:ResourceGroup
properties:
name: example-resources
location: West Europe
exampleKeyVault:
type: azure:keyvault:KeyVault
name: example
properties:
name: examplekeyvault
location: ${example.location}
resourceGroupName: ${example.name}
tenantId: ${current.tenantId}
skuName: premium
accessPolicies:
- tenantId: ${current.tenantId}
objectId: ${current.objectId}
certificatePermissions:
- Create
- Delete
- DeleteIssuers
- Get
- GetIssuers
- Import
- List
- ListIssuers
- ManageContacts
- ManageIssuers
- SetIssuers
- Update
keyPermissions:
- Backup
- Create
- Decrypt
- Delete
- Encrypt
- Get
- Import
- List
- Purge
- Recover
- Restore
- Sign
- UnwrapKey
- Update
- Verify
- WrapKey
secretPermissions:
- Backup
- Delete
- Get
- List
- Purge
- Recover
- Restore
- Set
exampleCertificate:
type: azure:keyvault:Certificate
name: example
properties:
name: imported-cert
keyVaultId: ${exampleKeyVault.id}
certificate:
contents:
fn::invoke:
function: std:filebase64
arguments:
input: certificate-to-import.pfx
return: result
password: ""
variables:
current:
fn::invoke:
function: azure:core:getClientConfig
arguments: {}
Generating a new certificate
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
const current = azure.core.getClientConfig({});
const example = new azure.core.ResourceGroup("example", {
name: "example-resources",
location: "West Europe",
});
const exampleKeyVault = new azure.keyvault.KeyVault("example", {
name: "examplekeyvault",
location: example.location,
resourceGroupName: example.name,
tenantId: current.then(current => current.tenantId),
skuName: "standard",
softDeleteRetentionDays: 7,
accessPolicies: [{
tenantId: current.then(current => current.tenantId),
objectId: current.then(current => current.objectId),
certificatePermissions: [
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"Purge",
"SetIssuers",
"Update",
],
keyPermissions: [
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
],
secretPermissions: [
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
],
}],
});
const exampleCertificate = new azure.keyvault.Certificate("example", {
name: "generated-cert",
keyVaultId: exampleKeyVault.id,
certificatePolicy: {
issuerParameters: {
name: "Self",
},
keyProperties: {
exportable: true,
keySize: 2048,
keyType: "RSA",
reuseKey: true,
},
lifetimeActions: [{
action: {
actionType: "AutoRenew",
},
trigger: {
daysBeforeExpiry: 30,
},
}],
secretProperties: {
contentType: "application/x-pkcs12",
},
x509CertificateProperties: {
extendedKeyUsages: ["1.3.6.1.5.5.7.3.1"],
keyUsages: [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
],
subjectAlternativeNames: {
dnsNames: [
"internal.contoso.com",
"domain.hello.world",
],
},
subject: "CN=hello-world",
validityInMonths: 12,
},
},
});
import pulumi
import pulumi_azure as azure
current = azure.core.get_client_config()
example = azure.core.ResourceGroup("example",
name="example-resources",
location="West Europe")
example_key_vault = azure.keyvault.KeyVault("example",
name="examplekeyvault",
location=example.location,
resource_group_name=example.name,
tenant_id=current.tenant_id,
sku_name="standard",
soft_delete_retention_days=7,
access_policies=[{
"tenant_id": current.tenant_id,
"object_id": current.object_id,
"certificate_permissions": [
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"Purge",
"SetIssuers",
"Update",
],
"key_permissions": [
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
],
"secret_permissions": [
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
],
}])
example_certificate = azure.keyvault.Certificate("example",
name="generated-cert",
key_vault_id=example_key_vault.id,
certificate_policy={
"issuer_parameters": {
"name": "Self",
},
"key_properties": {
"exportable": True,
"key_size": 2048,
"key_type": "RSA",
"reuse_key": True,
},
"lifetime_actions": [{
"action": {
"action_type": "AutoRenew",
},
"trigger": {
"days_before_expiry": 30,
},
}],
"secret_properties": {
"content_type": "application/x-pkcs12",
},
"x509_certificate_properties": {
"extended_key_usages": ["1.3.6.1.5.5.7.3.1"],
"key_usages": [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
],
"subject_alternative_names": {
"dns_names": [
"internal.contoso.com",
"domain.hello.world",
],
},
"subject": "CN=hello-world",
"validity_in_months": 12,
},
})
package main
import (
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/keyvault"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
current, err := core.GetClientConfig(ctx, map[string]interface{}{}, nil)
if err != nil {
return err
}
example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
Name: pulumi.String("example-resources"),
Location: pulumi.String("West Europe"),
})
if err != nil {
return err
}
exampleKeyVault, err := keyvault.NewKeyVault(ctx, "example", &keyvault.KeyVaultArgs{
Name: pulumi.String("examplekeyvault"),
Location: example.Location,
ResourceGroupName: example.Name,
TenantId: pulumi.String(current.TenantId),
SkuName: pulumi.String("standard"),
SoftDeleteRetentionDays: pulumi.Int(7),
AccessPolicies: keyvault.KeyVaultAccessPolicyArray{
&keyvault.KeyVaultAccessPolicyArgs{
TenantId: pulumi.String(current.TenantId),
ObjectId: pulumi.String(current.ObjectId),
CertificatePermissions: pulumi.StringArray{
pulumi.String("Create"),
pulumi.String("Delete"),
pulumi.String("DeleteIssuers"),
pulumi.String("Get"),
pulumi.String("GetIssuers"),
pulumi.String("Import"),
pulumi.String("List"),
pulumi.String("ListIssuers"),
pulumi.String("ManageContacts"),
pulumi.String("ManageIssuers"),
pulumi.String("Purge"),
pulumi.String("SetIssuers"),
pulumi.String("Update"),
},
KeyPermissions: pulumi.StringArray{
pulumi.String("Backup"),
pulumi.String("Create"),
pulumi.String("Decrypt"),
pulumi.String("Delete"),
pulumi.String("Encrypt"),
pulumi.String("Get"),
pulumi.String("Import"),
pulumi.String("List"),
pulumi.String("Purge"),
pulumi.String("Recover"),
pulumi.String("Restore"),
pulumi.String("Sign"),
pulumi.String("UnwrapKey"),
pulumi.String("Update"),
pulumi.String("Verify"),
pulumi.String("WrapKey"),
},
SecretPermissions: pulumi.StringArray{
pulumi.String("Backup"),
pulumi.String("Delete"),
pulumi.String("Get"),
pulumi.String("List"),
pulumi.String("Purge"),
pulumi.String("Recover"),
pulumi.String("Restore"),
pulumi.String("Set"),
},
},
},
})
if err != nil {
return err
}
_, err = keyvault.NewCertificate(ctx, "example", &keyvault.CertificateArgs{
Name: pulumi.String("generated-cert"),
KeyVaultId: exampleKeyVault.ID(),
CertificatePolicy: &keyvault.CertificateCertificatePolicyArgs{
IssuerParameters: &keyvault.CertificateCertificatePolicyIssuerParametersArgs{
Name: pulumi.String("Self"),
},
KeyProperties: &keyvault.CertificateCertificatePolicyKeyPropertiesArgs{
Exportable: pulumi.Bool(true),
KeySize: pulumi.Int(2048),
KeyType: pulumi.String("RSA"),
ReuseKey: pulumi.Bool(true),
},
LifetimeActions: keyvault.CertificateCertificatePolicyLifetimeActionArray{
&keyvault.CertificateCertificatePolicyLifetimeActionArgs{
Action: &keyvault.CertificateCertificatePolicyLifetimeActionActionArgs{
ActionType: pulumi.String("AutoRenew"),
},
Trigger: &keyvault.CertificateCertificatePolicyLifetimeActionTriggerArgs{
DaysBeforeExpiry: pulumi.Int(30),
},
},
},
SecretProperties: &keyvault.CertificateCertificatePolicySecretPropertiesArgs{
ContentType: pulumi.String("application/x-pkcs12"),
},
X509CertificateProperties: &keyvault.CertificateCertificatePolicyX509CertificatePropertiesArgs{
ExtendedKeyUsages: pulumi.StringArray{
pulumi.String("1.3.6.1.5.5.7.3.1"),
},
KeyUsages: pulumi.StringArray{
pulumi.String("cRLSign"),
pulumi.String("dataEncipherment"),
pulumi.String("digitalSignature"),
pulumi.String("keyAgreement"),
pulumi.String("keyCertSign"),
pulumi.String("keyEncipherment"),
},
SubjectAlternativeNames: &keyvault.CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs{
DnsNames: pulumi.StringArray{
pulumi.String("internal.contoso.com"),
pulumi.String("domain.hello.world"),
},
},
Subject: pulumi.String("CN=hello-world"),
ValidityInMonths: pulumi.Int(12),
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
return await Deployment.RunAsync(() =>
{
var current = Azure.Core.GetClientConfig.Invoke();
var example = new Azure.Core.ResourceGroup("example", new()
{
Name = "example-resources",
Location = "West Europe",
});
var exampleKeyVault = new Azure.KeyVault.KeyVault("example", new()
{
Name = "examplekeyvault",
Location = example.Location,
ResourceGroupName = example.Name,
TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
SkuName = "standard",
SoftDeleteRetentionDays = 7,
AccessPolicies = new[]
{
new Azure.KeyVault.Inputs.KeyVaultAccessPolicyArgs
{
TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
ObjectId = current.Apply(getClientConfigResult => getClientConfigResult.ObjectId),
CertificatePermissions = new[]
{
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"Purge",
"SetIssuers",
"Update",
},
KeyPermissions = new[]
{
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey",
},
SecretPermissions = new[]
{
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set",
},
},
},
});
var exampleCertificate = new Azure.KeyVault.Certificate("example", new()
{
Name = "generated-cert",
KeyVaultId = exampleKeyVault.Id,
CertificatePolicy = new Azure.KeyVault.Inputs.CertificateCertificatePolicyArgs
{
IssuerParameters = new Azure.KeyVault.Inputs.CertificateCertificatePolicyIssuerParametersArgs
{
Name = "Self",
},
KeyProperties = new Azure.KeyVault.Inputs.CertificateCertificatePolicyKeyPropertiesArgs
{
Exportable = true,
KeySize = 2048,
KeyType = "RSA",
ReuseKey = true,
},
LifetimeActions = new[]
{
new Azure.KeyVault.Inputs.CertificateCertificatePolicyLifetimeActionArgs
{
Action = new Azure.KeyVault.Inputs.CertificateCertificatePolicyLifetimeActionActionArgs
{
ActionType = "AutoRenew",
},
Trigger = new Azure.KeyVault.Inputs.CertificateCertificatePolicyLifetimeActionTriggerArgs
{
DaysBeforeExpiry = 30,
},
},
},
SecretProperties = new Azure.KeyVault.Inputs.CertificateCertificatePolicySecretPropertiesArgs
{
ContentType = "application/x-pkcs12",
},
X509CertificateProperties = new Azure.KeyVault.Inputs.CertificateCertificatePolicyX509CertificatePropertiesArgs
{
ExtendedKeyUsages = new[]
{
"1.3.6.1.5.5.7.3.1",
},
KeyUsages = new[]
{
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
},
SubjectAlternativeNames = new Azure.KeyVault.Inputs.CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs
{
DnsNames = new[]
{
"internal.contoso.com",
"domain.hello.world",
},
},
Subject = "CN=hello-world",
ValidityInMonths = 12,
},
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Certificate;
import com.pulumi.azure.keyvault.CertificateArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyIssuerParametersArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyKeyPropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicySecretPropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyX509CertificatePropertiesArgs;
import com.pulumi.azure.keyvault.inputs.CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var current = CoreFunctions.getClientConfig(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference);
var example = new ResourceGroup("example", ResourceGroupArgs.builder()
.name("example-resources")
.location("West Europe")
.build());
var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
.name("examplekeyvault")
.location(example.location())
.resourceGroupName(example.name())
.tenantId(current.tenantId())
.skuName("standard")
.softDeleteRetentionDays(7)
.accessPolicies(KeyVaultAccessPolicyArgs.builder()
.tenantId(current.tenantId())
.objectId(current.objectId())
.certificatePermissions(
"Create",
"Delete",
"DeleteIssuers",
"Get",
"GetIssuers",
"Import",
"List",
"ListIssuers",
"ManageContacts",
"ManageIssuers",
"Purge",
"SetIssuers",
"Update")
.keyPermissions(
"Backup",
"Create",
"Decrypt",
"Delete",
"Encrypt",
"Get",
"Import",
"List",
"Purge",
"Recover",
"Restore",
"Sign",
"UnwrapKey",
"Update",
"Verify",
"WrapKey")
.secretPermissions(
"Backup",
"Delete",
"Get",
"List",
"Purge",
"Recover",
"Restore",
"Set")
.build())
.build());
var exampleCertificate = new Certificate("exampleCertificate", CertificateArgs.builder()
.name("generated-cert")
.keyVaultId(exampleKeyVault.id())
.certificatePolicy(CertificateCertificatePolicyArgs.builder()
.issuerParameters(CertificateCertificatePolicyIssuerParametersArgs.builder()
.name("Self")
.build())
.keyProperties(CertificateCertificatePolicyKeyPropertiesArgs.builder()
.exportable(true)
.keySize(2048)
.keyType("RSA")
.reuseKey(true)
.build())
.lifetimeActions(CertificateCertificatePolicyLifetimeActionArgs.builder()
.action(CertificateCertificatePolicyLifetimeActionActionArgs.builder()
.actionType("AutoRenew")
.build())
.trigger(CertificateCertificatePolicyLifetimeActionTriggerArgs.builder()
.daysBeforeExpiry(30)
.build())
.build())
.secretProperties(CertificateCertificatePolicySecretPropertiesArgs.builder()
.contentType("application/x-pkcs12")
.build())
.x509CertificateProperties(CertificateCertificatePolicyX509CertificatePropertiesArgs.builder()
.extendedKeyUsages("1.3.6.1.5.5.7.3.1")
.keyUsages(
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment")
.subjectAlternativeNames(CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs.builder()
.dnsNames(
"internal.contoso.com",
"domain.hello.world")
.build())
.subject("CN=hello-world")
.validityInMonths(12)
.build())
.build())
.build());
}
}
resources:
example:
type: azure:core:ResourceGroup
properties:
name: example-resources
location: West Europe
exampleKeyVault:
type: azure:keyvault:KeyVault
name: example
properties:
name: examplekeyvault
location: ${example.location}
resourceGroupName: ${example.name}
tenantId: ${current.tenantId}
skuName: standard
softDeleteRetentionDays: 7
accessPolicies:
- tenantId: ${current.tenantId}
objectId: ${current.objectId}
certificatePermissions:
- Create
- Delete
- DeleteIssuers
- Get
- GetIssuers
- Import
- List
- ListIssuers
- ManageContacts
- ManageIssuers
- Purge
- SetIssuers
- Update
keyPermissions:
- Backup
- Create
- Decrypt
- Delete
- Encrypt
- Get
- Import
- List
- Purge
- Recover
- Restore
- Sign
- UnwrapKey
- Update
- Verify
- WrapKey
secretPermissions:
- Backup
- Delete
- Get
- List
- Purge
- Recover
- Restore
- Set
exampleCertificate:
type: azure:keyvault:Certificate
name: example
properties:
name: generated-cert
keyVaultId: ${exampleKeyVault.id}
certificatePolicy:
issuerParameters:
name: Self
keyProperties:
exportable: true
keySize: 2048
keyType: RSA
reuseKey: true
lifetimeActions:
- action:
actionType: AutoRenew
trigger:
daysBeforeExpiry: 30
secretProperties:
contentType: application/x-pkcs12
x509CertificateProperties:
extendedKeyUsages:
- 1.3.6.1.5.5.7.3.1
keyUsages:
- cRLSign
- dataEncipherment
- digitalSignature
- keyAgreement
- keyCertSign
- keyEncipherment
subjectAlternativeNames:
dnsNames:
- internal.contoso.com
- domain.hello.world
subject: CN=hello-world
validityInMonths: 12
variables:
current:
fn::invoke:
function: azure:core:getClientConfig
arguments: {}
Create Certificate Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new Certificate(name: string, args: CertificateArgs, opts?: CustomResourceOptions);@overload
def Certificate(resource_name: str,
args: CertificateArgs,
opts: Optional[ResourceOptions] = None)
@overload
def Certificate(resource_name: str,
opts: Optional[ResourceOptions] = None,
key_vault_id: Optional[str] = None,
certificate: Optional[CertificateCertificateArgs] = None,
certificate_policy: Optional[CertificateCertificatePolicyArgs] = None,
name: Optional[str] = None,
tags: Optional[Mapping[str, str]] = None)func NewCertificate(ctx *Context, name string, args CertificateArgs, opts ...ResourceOption) (*Certificate, error)public Certificate(string name, CertificateArgs args, CustomResourceOptions? opts = null)
public Certificate(String name, CertificateArgs args)
public Certificate(String name, CertificateArgs args, CustomResourceOptions options)
type: azure:keyvault:Certificate
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args CertificateArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var examplecertificateResourceResourceFromKeyvaultcertificate = new Azure.KeyVault.Certificate("examplecertificateResourceResourceFromKeyvaultcertificate", new()
{
KeyVaultId = "string",
KeyVaultCertificate = new Azure.KeyVault.Inputs.CertificateCertificateArgs
{
Contents = "string",
Password = "string",
},
CertificatePolicy = new Azure.KeyVault.Inputs.CertificateCertificatePolicyArgs
{
IssuerParameters = new Azure.KeyVault.Inputs.CertificateCertificatePolicyIssuerParametersArgs
{
Name = "string",
},
KeyProperties = new Azure.KeyVault.Inputs.CertificateCertificatePolicyKeyPropertiesArgs
{
Exportable = false,
KeyType = "string",
ReuseKey = false,
Curve = "string",
KeySize = 0,
},
SecretProperties = new Azure.KeyVault.Inputs.CertificateCertificatePolicySecretPropertiesArgs
{
ContentType = "string",
},
LifetimeActions = new[]
{
new Azure.KeyVault.Inputs.CertificateCertificatePolicyLifetimeActionArgs
{
Action = new Azure.KeyVault.Inputs.CertificateCertificatePolicyLifetimeActionActionArgs
{
ActionType = "string",
},
Trigger = new Azure.KeyVault.Inputs.CertificateCertificatePolicyLifetimeActionTriggerArgs
{
DaysBeforeExpiry = 0,
LifetimePercentage = 0,
},
},
},
X509CertificateProperties = new Azure.KeyVault.Inputs.CertificateCertificatePolicyX509CertificatePropertiesArgs
{
KeyUsages = new[]
{
"string",
},
Subject = "string",
ValidityInMonths = 0,
ExtendedKeyUsages = new[]
{
"string",
},
SubjectAlternativeNames = new Azure.KeyVault.Inputs.CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs
{
DnsNames = new[]
{
"string",
},
Emails = new[]
{
"string",
},
Upns = new[]
{
"string",
},
},
},
},
Name = "string",
Tags =
{
{ "string", "string" },
},
});
example, err := keyvault.NewCertificate(ctx, "examplecertificateResourceResourceFromKeyvaultcertificate", &keyvault.CertificateArgs{
KeyVaultId: pulumi.String("string"),
Certificate: &keyvault.CertificateCertificateArgs{
Contents: pulumi.String("string"),
Password: pulumi.String("string"),
},
CertificatePolicy: &keyvault.CertificateCertificatePolicyArgs{
IssuerParameters: &keyvault.CertificateCertificatePolicyIssuerParametersArgs{
Name: pulumi.String("string"),
},
KeyProperties: &keyvault.CertificateCertificatePolicyKeyPropertiesArgs{
Exportable: pulumi.Bool(false),
KeyType: pulumi.String("string"),
ReuseKey: pulumi.Bool(false),
Curve: pulumi.String("string"),
KeySize: pulumi.Int(0),
},
SecretProperties: &keyvault.CertificateCertificatePolicySecretPropertiesArgs{
ContentType: pulumi.String("string"),
},
LifetimeActions: keyvault.CertificateCertificatePolicyLifetimeActionArray{
&keyvault.CertificateCertificatePolicyLifetimeActionArgs{
Action: &keyvault.CertificateCertificatePolicyLifetimeActionActionArgs{
ActionType: pulumi.String("string"),
},
Trigger: &keyvault.CertificateCertificatePolicyLifetimeActionTriggerArgs{
DaysBeforeExpiry: pulumi.Int(0),
LifetimePercentage: pulumi.Int(0),
},
},
},
X509CertificateProperties: &keyvault.CertificateCertificatePolicyX509CertificatePropertiesArgs{
KeyUsages: pulumi.StringArray{
pulumi.String("string"),
},
Subject: pulumi.String("string"),
ValidityInMonths: pulumi.Int(0),
ExtendedKeyUsages: pulumi.StringArray{
pulumi.String("string"),
},
SubjectAlternativeNames: &keyvault.CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs{
DnsNames: pulumi.StringArray{
pulumi.String("string"),
},
Emails: pulumi.StringArray{
pulumi.String("string"),
},
Upns: pulumi.StringArray{
pulumi.String("string"),
},
},
},
},
Name: pulumi.String("string"),
Tags: pulumi.StringMap{
"string": pulumi.String("string"),
},
})
var examplecertificateResourceResourceFromKeyvaultcertificate = new com.pulumi.azure.keyvault.Certificate("examplecertificateResourceResourceFromKeyvaultcertificate", com.pulumi.azure.keyvault.CertificateArgs.builder()
.keyVaultId("string")
.certificate(CertificateCertificateArgs.builder()
.contents("string")
.password("string")
.build())
.certificatePolicy(CertificateCertificatePolicyArgs.builder()
.issuerParameters(CertificateCertificatePolicyIssuerParametersArgs.builder()
.name("string")
.build())
.keyProperties(CertificateCertificatePolicyKeyPropertiesArgs.builder()
.exportable(false)
.keyType("string")
.reuseKey(false)
.curve("string")
.keySize(0)
.build())
.secretProperties(CertificateCertificatePolicySecretPropertiesArgs.builder()
.contentType("string")
.build())
.lifetimeActions(CertificateCertificatePolicyLifetimeActionArgs.builder()
.action(CertificateCertificatePolicyLifetimeActionActionArgs.builder()
.actionType("string")
.build())
.trigger(CertificateCertificatePolicyLifetimeActionTriggerArgs.builder()
.daysBeforeExpiry(0)
.lifetimePercentage(0)
.build())
.build())
.x509CertificateProperties(CertificateCertificatePolicyX509CertificatePropertiesArgs.builder()
.keyUsages("string")
.subject("string")
.validityInMonths(0)
.extendedKeyUsages("string")
.subjectAlternativeNames(CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs.builder()
.dnsNames("string")
.emails("string")
.upns("string")
.build())
.build())
.build())
.name("string")
.tags(Map.of("string", "string"))
.build());
examplecertificate_resource_resource_from_keyvaultcertificate = azure.keyvault.Certificate("examplecertificateResourceResourceFromKeyvaultcertificate",
key_vault_id="string",
certificate={
"contents": "string",
"password": "string",
},
certificate_policy={
"issuer_parameters": {
"name": "string",
},
"key_properties": {
"exportable": False,
"key_type": "string",
"reuse_key": False,
"curve": "string",
"key_size": 0,
},
"secret_properties": {
"content_type": "string",
},
"lifetime_actions": [{
"action": {
"action_type": "string",
},
"trigger": {
"days_before_expiry": 0,
"lifetime_percentage": 0,
},
}],
"x509_certificate_properties": {
"key_usages": ["string"],
"subject": "string",
"validity_in_months": 0,
"extended_key_usages": ["string"],
"subject_alternative_names": {
"dns_names": ["string"],
"emails": ["string"],
"upns": ["string"],
},
},
},
name="string",
tags={
"string": "string",
})
const examplecertificateResourceResourceFromKeyvaultcertificate = new azure.keyvault.Certificate("examplecertificateResourceResourceFromKeyvaultcertificate", {
keyVaultId: "string",
certificate: {
contents: "string",
password: "string",
},
certificatePolicy: {
issuerParameters: {
name: "string",
},
keyProperties: {
exportable: false,
keyType: "string",
reuseKey: false,
curve: "string",
keySize: 0,
},
secretProperties: {
contentType: "string",
},
lifetimeActions: [{
action: {
actionType: "string",
},
trigger: {
daysBeforeExpiry: 0,
lifetimePercentage: 0,
},
}],
x509CertificateProperties: {
keyUsages: ["string"],
subject: "string",
validityInMonths: 0,
extendedKeyUsages: ["string"],
subjectAlternativeNames: {
dnsNames: ["string"],
emails: ["string"],
upns: ["string"],
},
},
},
name: "string",
tags: {
string: "string",
},
});
type: azure:keyvault:Certificate
properties:
certificate:
contents: string
password: string
certificatePolicy:
issuerParameters:
name: string
keyProperties:
curve: string
exportable: false
keySize: 0
keyType: string
reuseKey: false
lifetimeActions:
- action:
actionType: string
trigger:
daysBeforeExpiry: 0
lifetimePercentage: 0
secretProperties:
contentType: string
x509CertificateProperties:
extendedKeyUsages:
- string
keyUsages:
- string
subject: string
subjectAlternativeNames:
dnsNames:
- string
emails:
- string
upns:
- string
validityInMonths: 0
keyVaultId: string
name: string
tags:
string: string
Certificate Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The Certificate resource accepts the following input properties:
- Key
Vault stringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- Certificate
Policy CertificateCertificate Policy A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- Key
Vault CertificateCertificate Certificate - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - Name string
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- Dictionary<string, string>
- A mapping of tags to assign to the resource.
- Key
Vault stringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- Certificate
Certificate
Certificate Args - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - Certificate
Policy CertificateCertificate Policy Args A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- Name string
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- map[string]string
- A mapping of tags to assign to the resource.
- key
Vault StringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- certificate
Certificate
Certificate - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - certificate
Policy CertificateCertificate Policy A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- name String
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- Map<String,String>
- A mapping of tags to assign to the resource.
- key
Vault stringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- certificate
Certificate
Certificate - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - certificate
Policy CertificateCertificate Policy A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- name string
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- {[key: string]: string}
- A mapping of tags to assign to the resource.
- key_
vault_ strid - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- certificate
Certificate
Certificate Args - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - certificate_
policy CertificateCertificate Policy Args A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- name str
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- Mapping[str, str]
- A mapping of tags to assign to the resource.
- key
Vault StringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- certificate Property Map
- A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - certificate
Policy Property Map A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- name String
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- Map<String>
- A mapping of tags to assign to the resource.
Outputs
All input properties are implicitly available as output properties. Additionally, the Certificate resource produces the following output properties:
- Certificate
Attributes List<CertificateCertificate Attribute> - A
certificate_attributeblock as defined below. - Certificate
Data string - The raw Key Vault Certificate data represented as a hexadecimal string.
- Certificate
Data stringBase64 - The Base64 encoded Key Vault Certificate data.
- Id string
- The provider-assigned unique ID for this managed resource.
- Resource
Manager stringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- Resource
Manager stringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- Secret
Id string - The ID of the associated Key Vault Secret.
- Thumbprint string
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- Version string
- The current version of the Key Vault Certificate.
- Versionless
Id string - The Base ID of the Key Vault Certificate.
- Versionless
Secret stringId - The Base ID of the Key Vault Secret.
- Certificate
Attributes []CertificateCertificate Attribute - A
certificate_attributeblock as defined below. - Certificate
Data string - The raw Key Vault Certificate data represented as a hexadecimal string.
- Certificate
Data stringBase64 - The Base64 encoded Key Vault Certificate data.
- Id string
- The provider-assigned unique ID for this managed resource.
- Resource
Manager stringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- Resource
Manager stringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- Secret
Id string - The ID of the associated Key Vault Secret.
- Thumbprint string
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- Version string
- The current version of the Key Vault Certificate.
- Versionless
Id string - The Base ID of the Key Vault Certificate.
- Versionless
Secret stringId - The Base ID of the Key Vault Secret.
- certificate
Attributes List<CertificateCertificate Attribute> - A
certificate_attributeblock as defined below. - certificate
Data String - The raw Key Vault Certificate data represented as a hexadecimal string.
- certificate
Data StringBase64 - The Base64 encoded Key Vault Certificate data.
- id String
- The provider-assigned unique ID for this managed resource.
- resource
Manager StringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- resource
Manager StringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- secret
Id String - The ID of the associated Key Vault Secret.
- thumbprint String
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- version String
- The current version of the Key Vault Certificate.
- versionless
Id String - The Base ID of the Key Vault Certificate.
- versionless
Secret StringId - The Base ID of the Key Vault Secret.
- certificate
Attributes CertificateCertificate Attribute[] - A
certificate_attributeblock as defined below. - certificate
Data string - The raw Key Vault Certificate data represented as a hexadecimal string.
- certificate
Data stringBase64 - The Base64 encoded Key Vault Certificate data.
- id string
- The provider-assigned unique ID for this managed resource.
- resource
Manager stringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- resource
Manager stringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- secret
Id string - The ID of the associated Key Vault Secret.
- thumbprint string
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- version string
- The current version of the Key Vault Certificate.
- versionless
Id string - The Base ID of the Key Vault Certificate.
- versionless
Secret stringId - The Base ID of the Key Vault Secret.
- certificate_
attributes Sequence[CertificateCertificate Attribute] - A
certificate_attributeblock as defined below. - certificate_
data str - The raw Key Vault Certificate data represented as a hexadecimal string.
- certificate_
data_ strbase64 - The Base64 encoded Key Vault Certificate data.
- id str
- The provider-assigned unique ID for this managed resource.
- resource_
manager_ strid - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- resource_
manager_ strversionless_ id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- secret_
id str - The ID of the associated Key Vault Secret.
- thumbprint str
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- version str
- The current version of the Key Vault Certificate.
- versionless_
id str - The Base ID of the Key Vault Certificate.
- versionless_
secret_ strid - The Base ID of the Key Vault Secret.
- certificate
Attributes List<Property Map> - A
certificate_attributeblock as defined below. - certificate
Data String - The raw Key Vault Certificate data represented as a hexadecimal string.
- certificate
Data StringBase64 - The Base64 encoded Key Vault Certificate data.
- id String
- The provider-assigned unique ID for this managed resource.
- resource
Manager StringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- resource
Manager StringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- secret
Id String - The ID of the associated Key Vault Secret.
- thumbprint String
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- version String
- The current version of the Key Vault Certificate.
- versionless
Id String - The Base ID of the Key Vault Certificate.
- versionless
Secret StringId - The Base ID of the Key Vault Secret.
Look up Existing Certificate Resource
Get an existing Certificate resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: CertificateState, opts?: CustomResourceOptions): Certificate@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
certificate: Optional[CertificateCertificateArgs] = None,
certificate_attributes: Optional[Sequence[CertificateCertificateAttributeArgs]] = None,
certificate_data: Optional[str] = None,
certificate_data_base64: Optional[str] = None,
certificate_policy: Optional[CertificateCertificatePolicyArgs] = None,
key_vault_id: Optional[str] = None,
name: Optional[str] = None,
resource_manager_id: Optional[str] = None,
resource_manager_versionless_id: Optional[str] = None,
secret_id: Optional[str] = None,
tags: Optional[Mapping[str, str]] = None,
thumbprint: Optional[str] = None,
version: Optional[str] = None,
versionless_id: Optional[str] = None,
versionless_secret_id: Optional[str] = None) -> Certificatefunc GetCertificate(ctx *Context, name string, id IDInput, state *CertificateState, opts ...ResourceOption) (*Certificate, error)public static Certificate Get(string name, Input<string> id, CertificateState? state, CustomResourceOptions? opts = null)public static Certificate get(String name, Output<String> id, CertificateState state, CustomResourceOptions options)resources: _: type: azure:keyvault:Certificate get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Certificate
Attributes List<CertificateCertificate Attribute> - A
certificate_attributeblock as defined below. - Certificate
Data string - The raw Key Vault Certificate data represented as a hexadecimal string.
- Certificate
Data stringBase64 - The Base64 encoded Key Vault Certificate data.
- Certificate
Policy CertificateCertificate Policy A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- Key
Vault CertificateCertificate Certificate - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - Key
Vault stringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- Name string
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- Resource
Manager stringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- Resource
Manager stringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- Secret
Id string - The ID of the associated Key Vault Secret.
- Dictionary<string, string>
- A mapping of tags to assign to the resource.
- Thumbprint string
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- Version string
- The current version of the Key Vault Certificate.
- Versionless
Id string - The Base ID of the Key Vault Certificate.
- Versionless
Secret stringId - The Base ID of the Key Vault Secret.
- Certificate
Certificate
Certificate Args - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - Certificate
Attributes []CertificateCertificate Attribute Args - A
certificate_attributeblock as defined below. - Certificate
Data string - The raw Key Vault Certificate data represented as a hexadecimal string.
- Certificate
Data stringBase64 - The Base64 encoded Key Vault Certificate data.
- Certificate
Policy CertificateCertificate Policy Args A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- Key
Vault stringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- Name string
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- Resource
Manager stringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- Resource
Manager stringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- Secret
Id string - The ID of the associated Key Vault Secret.
- map[string]string
- A mapping of tags to assign to the resource.
- Thumbprint string
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- Version string
- The current version of the Key Vault Certificate.
- Versionless
Id string - The Base ID of the Key Vault Certificate.
- Versionless
Secret stringId - The Base ID of the Key Vault Secret.
- certificate
Certificate
Certificate - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - certificate
Attributes List<CertificateCertificate Attribute> - A
certificate_attributeblock as defined below. - certificate
Data String - The raw Key Vault Certificate data represented as a hexadecimal string.
- certificate
Data StringBase64 - The Base64 encoded Key Vault Certificate data.
- certificate
Policy CertificateCertificate Policy A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- key
Vault StringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- name String
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- resource
Manager StringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- resource
Manager StringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- secret
Id String - The ID of the associated Key Vault Secret.
- Map<String,String>
- A mapping of tags to assign to the resource.
- thumbprint String
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- version String
- The current version of the Key Vault Certificate.
- versionless
Id String - The Base ID of the Key Vault Certificate.
- versionless
Secret StringId - The Base ID of the Key Vault Secret.
- certificate
Certificate
Certificate - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - certificate
Attributes CertificateCertificate Attribute[] - A
certificate_attributeblock as defined below. - certificate
Data string - The raw Key Vault Certificate data represented as a hexadecimal string.
- certificate
Data stringBase64 - The Base64 encoded Key Vault Certificate data.
- certificate
Policy CertificateCertificate Policy A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- key
Vault stringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- name string
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- resource
Manager stringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- resource
Manager stringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- secret
Id string - The ID of the associated Key Vault Secret.
- {[key: string]: string}
- A mapping of tags to assign to the resource.
- thumbprint string
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- version string
- The current version of the Key Vault Certificate.
- versionless
Id string - The Base ID of the Key Vault Certificate.
- versionless
Secret stringId - The Base ID of the Key Vault Secret.
- certificate
Certificate
Certificate Args - A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - certificate_
attributes Sequence[CertificateCertificate Attribute Args] - A
certificate_attributeblock as defined below. - certificate_
data str - The raw Key Vault Certificate data represented as a hexadecimal string.
- certificate_
data_ strbase64 - The Base64 encoded Key Vault Certificate data.
- certificate_
policy CertificateCertificate Policy Args A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- key_
vault_ strid - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- name str
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- resource_
manager_ strid - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- resource_
manager_ strversionless_ id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- secret_
id str - The ID of the associated Key Vault Secret.
- Mapping[str, str]
- A mapping of tags to assign to the resource.
- thumbprint str
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- version str
- The current version of the Key Vault Certificate.
- versionless_
id str - The Base ID of the Key Vault Certificate.
- versionless_
secret_ strid - The Base ID of the Key Vault Secret.
- certificate Property Map
- A
certificateblock as defined below, used to Import an existing certificate. Changing this will create a new version of the Key Vault Certificate. - certificate
Attributes List<Property Map> - A
certificate_attributeblock as defined below. - certificate
Data String - The raw Key Vault Certificate data represented as a hexadecimal string.
- certificate
Data StringBase64 - The Base64 encoded Key Vault Certificate data.
- certificate
Policy Property Map A
certificate_policyblock as defined below. Changing this (except thelifetime_actionfield) will create a new version of the Key Vault Certificate.NOTE: When creating a Key Vault Certificate, at least one of
certificateorcertificate_policyis required. Providecertificateto import an existing certificate,certificate_policyto generate a new certificate.- key
Vault StringId - The ID of the Key Vault where the Certificate should be created. Changing this forces a new resource to be created.
- name String
- Specifies the name of the Key Vault Certificate. Changing this forces a new resource to be created.
- resource
Manager StringId - The (Versioned) ID for this Key Vault Certificate. This property points to a specific version of a Key Vault Certificate, as such using this won't auto-rotate values if used in other Azure Services.
- resource
Manager StringVersionless Id - The Versionless ID of the Key Vault Certificate. This property allows other Azure Services (that support it) to auto-rotate their value when the Key Vault Certificate is updated.
- secret
Id String - The ID of the associated Key Vault Secret.
- Map<String>
- A mapping of tags to assign to the resource.
- thumbprint String
- The X509 Thumbprint of the Key Vault Certificate represented as a hexadecimal string.
- version String
- The current version of the Key Vault Certificate.
- versionless
Id String - The Base ID of the Key Vault Certificate.
- versionless
Secret StringId - The Base ID of the Key Vault Secret.
Supporting Types
CertificateCertificate, CertificateCertificateArgs
- Contents string
- The base64-encoded certificate contents.
- Password string
The password associated with the certificate.
NOTE: A PEM certificate is already base64 encoded. To successfully import, the
contentsproperty should include a PEM encoded X509 certificate and a private_key in pkcs8 format. There should only be linux style\nline endings and the whole block should have the PEM begin/end blocks around the certificate data and the private key data.To convert a private key to pkcs8 format with openssl use:
openssl pkcs8 -topk8 -nocrypt -in private_key.pem > private_key_pk8.pemThe PEM content should look something like:
-----BEGIN CERTIFICATE----- aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K : aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK : d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK -----END PRIVATE KEY-----
- Contents string
- The base64-encoded certificate contents.
- Password string
The password associated with the certificate.
NOTE: A PEM certificate is already base64 encoded. To successfully import, the
contentsproperty should include a PEM encoded X509 certificate and a private_key in pkcs8 format. There should only be linux style\nline endings and the whole block should have the PEM begin/end blocks around the certificate data and the private key data.To convert a private key to pkcs8 format with openssl use:
openssl pkcs8 -topk8 -nocrypt -in private_key.pem > private_key_pk8.pemThe PEM content should look something like:
-----BEGIN CERTIFICATE----- aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K : aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK : d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK -----END PRIVATE KEY-----
- contents String
- The base64-encoded certificate contents.
- password String
The password associated with the certificate.
NOTE: A PEM certificate is already base64 encoded. To successfully import, the
contentsproperty should include a PEM encoded X509 certificate and a private_key in pkcs8 format. There should only be linux style\nline endings and the whole block should have the PEM begin/end blocks around the certificate data and the private key data.To convert a private key to pkcs8 format with openssl use:
openssl pkcs8 -topk8 -nocrypt -in private_key.pem > private_key_pk8.pemThe PEM content should look something like:
-----BEGIN CERTIFICATE----- aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K : aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK : d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK -----END PRIVATE KEY-----
- contents string
- The base64-encoded certificate contents.
- password string
The password associated with the certificate.
NOTE: A PEM certificate is already base64 encoded. To successfully import, the
contentsproperty should include a PEM encoded X509 certificate and a private_key in pkcs8 format. There should only be linux style\nline endings and the whole block should have the PEM begin/end blocks around the certificate data and the private key data.To convert a private key to pkcs8 format with openssl use:
openssl pkcs8 -topk8 -nocrypt -in private_key.pem > private_key_pk8.pemThe PEM content should look something like:
-----BEGIN CERTIFICATE----- aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K : aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK : d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK -----END PRIVATE KEY-----
- contents str
- The base64-encoded certificate contents.
- password str
The password associated with the certificate.
NOTE: A PEM certificate is already base64 encoded. To successfully import, the
contentsproperty should include a PEM encoded X509 certificate and a private_key in pkcs8 format. There should only be linux style\nline endings and the whole block should have the PEM begin/end blocks around the certificate data and the private key data.To convert a private key to pkcs8 format with openssl use:
openssl pkcs8 -topk8 -nocrypt -in private_key.pem > private_key_pk8.pemThe PEM content should look something like:
-----BEGIN CERTIFICATE----- aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K : aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK : d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK -----END PRIVATE KEY-----
- contents String
- The base64-encoded certificate contents.
- password String
The password associated with the certificate.
NOTE: A PEM certificate is already base64 encoded. To successfully import, the
contentsproperty should include a PEM encoded X509 certificate and a private_key in pkcs8 format. There should only be linux style\nline endings and the whole block should have the PEM begin/end blocks around the certificate data and the private key data.To convert a private key to pkcs8 format with openssl use:
openssl pkcs8 -topk8 -nocrypt -in private_key.pem > private_key_pk8.pemThe PEM content should look something like:
-----BEGIN CERTIFICATE----- aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K : aGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8KaGVsbG8K -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK : d29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQKd29ybGQK -----END PRIVATE KEY-----
CertificateCertificateAttribute, CertificateCertificateAttributeArgs
- Created string
- The create time of the Key Vault Certificate.
- Enabled bool
- whether the Key Vault Certificate is enabled.
- Expires string
- The expires time of the Key Vault Certificate.
- Not
Before string - The not before valid time of the Key Vault Certificate.
- Recovery
Level string - The deletion recovery level of the Key Vault Certificate.
- Updated string
- The recent update time of the Key Vault Certificate.
- Created string
- The create time of the Key Vault Certificate.
- Enabled bool
- whether the Key Vault Certificate is enabled.
- Expires string
- The expires time of the Key Vault Certificate.
- Not
Before string - The not before valid time of the Key Vault Certificate.
- Recovery
Level string - The deletion recovery level of the Key Vault Certificate.
- Updated string
- The recent update time of the Key Vault Certificate.
- created String
- The create time of the Key Vault Certificate.
- enabled Boolean
- whether the Key Vault Certificate is enabled.
- expires String
- The expires time of the Key Vault Certificate.
- not
Before String - The not before valid time of the Key Vault Certificate.
- recovery
Level String - The deletion recovery level of the Key Vault Certificate.
- updated String
- The recent update time of the Key Vault Certificate.
- created string
- The create time of the Key Vault Certificate.
- enabled boolean
- whether the Key Vault Certificate is enabled.
- expires string
- The expires time of the Key Vault Certificate.
- not
Before string - The not before valid time of the Key Vault Certificate.
- recovery
Level string - The deletion recovery level of the Key Vault Certificate.
- updated string
- The recent update time of the Key Vault Certificate.
- created str
- The create time of the Key Vault Certificate.
- enabled bool
- whether the Key Vault Certificate is enabled.
- expires str
- The expires time of the Key Vault Certificate.
- not_
before str - The not before valid time of the Key Vault Certificate.
- recovery_
level str - The deletion recovery level of the Key Vault Certificate.
- updated str
- The recent update time of the Key Vault Certificate.
- created String
- The create time of the Key Vault Certificate.
- enabled Boolean
- whether the Key Vault Certificate is enabled.
- expires String
- The expires time of the Key Vault Certificate.
- not
Before String - The not before valid time of the Key Vault Certificate.
- recovery
Level String - The deletion recovery level of the Key Vault Certificate.
- updated String
- The recent update time of the Key Vault Certificate.
CertificateCertificatePolicy, CertificateCertificatePolicyArgs
- Issuer
Parameters CertificateCertificate Policy Issuer Parameters - A
issuer_parametersblock as defined below. - Key
Properties CertificateCertificate Policy Key Properties - A
key_propertiesblock as defined below. - Secret
Properties CertificateCertificate Policy Secret Properties - A
secret_propertiesblock as defined below. - Lifetime
Actions List<CertificateCertificate Policy Lifetime Action> - A
lifetime_actionblock as defined below. - X509Certificate
Properties CertificateCertificate Policy X509Certificate Properties - A
x509_certificate_propertiesblock as defined below. Required whencertificateblock is not specified.
- Issuer
Parameters CertificateCertificate Policy Issuer Parameters - A
issuer_parametersblock as defined below. - Key
Properties CertificateCertificate Policy Key Properties - A
key_propertiesblock as defined below. - Secret
Properties CertificateCertificate Policy Secret Properties - A
secret_propertiesblock as defined below. - Lifetime
Actions []CertificateCertificate Policy Lifetime Action - A
lifetime_actionblock as defined below. - X509Certificate
Properties CertificateCertificate Policy X509Certificate Properties - A
x509_certificate_propertiesblock as defined below. Required whencertificateblock is not specified.
- issuer
Parameters CertificateCertificate Policy Issuer Parameters - A
issuer_parametersblock as defined below. - key
Properties CertificateCertificate Policy Key Properties - A
key_propertiesblock as defined below. - secret
Properties CertificateCertificate Policy Secret Properties - A
secret_propertiesblock as defined below. - lifetime
Actions List<CertificateCertificate Policy Lifetime Action> - A
lifetime_actionblock as defined below. - x509Certificate
Properties CertificateCertificate Policy X509Certificate Properties - A
x509_certificate_propertiesblock as defined below. Required whencertificateblock is not specified.
- issuer
Parameters CertificateCertificate Policy Issuer Parameters - A
issuer_parametersblock as defined below. - key
Properties CertificateCertificate Policy Key Properties - A
key_propertiesblock as defined below. - secret
Properties CertificateCertificate Policy Secret Properties - A
secret_propertiesblock as defined below. - lifetime
Actions CertificateCertificate Policy Lifetime Action[] - A
lifetime_actionblock as defined below. - x509Certificate
Properties CertificateCertificate Policy X509Certificate Properties - A
x509_certificate_propertiesblock as defined below. Required whencertificateblock is not specified.
- issuer_
parameters CertificateCertificate Policy Issuer Parameters - A
issuer_parametersblock as defined below. - key_
properties CertificateCertificate Policy Key Properties - A
key_propertiesblock as defined below. - secret_
properties CertificateCertificate Policy Secret Properties - A
secret_propertiesblock as defined below. - lifetime_
actions Sequence[CertificateCertificate Policy Lifetime Action] - A
lifetime_actionblock as defined below. - x509_
certificate_ Certificateproperties Certificate Policy X509Certificate Properties - A
x509_certificate_propertiesblock as defined below. Required whencertificateblock is not specified.
- issuer
Parameters Property Map - A
issuer_parametersblock as defined below. - key
Properties Property Map - A
key_propertiesblock as defined below. - secret
Properties Property Map - A
secret_propertiesblock as defined below. - lifetime
Actions List<Property Map> - A
lifetime_actionblock as defined below. - x509Certificate
Properties Property Map - A
x509_certificate_propertiesblock as defined below. Required whencertificateblock is not specified.
CertificateCertificatePolicyIssuerParameters, CertificateCertificatePolicyIssuerParametersArgs
- Name string
- The name of the Certificate Issuer. Possible values include
Self(for self-signed certificate), orUnknown(for a certificate issuing authority likeLet's Encryptand Azure direct supported ones).
- Name string
- The name of the Certificate Issuer. Possible values include
Self(for self-signed certificate), orUnknown(for a certificate issuing authority likeLet's Encryptand Azure direct supported ones).
- name String
- The name of the Certificate Issuer. Possible values include
Self(for self-signed certificate), orUnknown(for a certificate issuing authority likeLet's Encryptand Azure direct supported ones).
- name string
- The name of the Certificate Issuer. Possible values include
Self(for self-signed certificate), orUnknown(for a certificate issuing authority likeLet's Encryptand Azure direct supported ones).
- name str
- The name of the Certificate Issuer. Possible values include
Self(for self-signed certificate), orUnknown(for a certificate issuing authority likeLet's Encryptand Azure direct supported ones).
- name String
- The name of the Certificate Issuer. Possible values include
Self(for self-signed certificate), orUnknown(for a certificate issuing authority likeLet's Encryptand Azure direct supported ones).
CertificateCertificatePolicyKeyProperties, CertificateCertificatePolicyKeyPropertiesArgs
- Exportable bool
- Is this certificate exportable?
- Key
Type string - Specifies the type of key. Possible values are
EC,EC-HSM,RSA,RSA-HSMandoct. - Reuse
Key bool - Is the key reusable?
- Curve string
- Specifies the curve to use when creating an
ECkey. Possible values areP-256,P-256K,P-384, andP-521. This field will be required in a future release ifkey_typeisECorEC-HSM. - Key
Size int - The size of the key used in the certificate. Possible values include
2048,3072, and4096forRSAkeys, or256,384, and521forECkeys. This property is required when using RSA keys.
- Exportable bool
- Is this certificate exportable?
- Key
Type string - Specifies the type of key. Possible values are
EC,EC-HSM,RSA,RSA-HSMandoct. - Reuse
Key bool - Is the key reusable?
- Curve string
- Specifies the curve to use when creating an
ECkey. Possible values areP-256,P-256K,P-384, andP-521. This field will be required in a future release ifkey_typeisECorEC-HSM. - Key
Size int - The size of the key used in the certificate. Possible values include
2048,3072, and4096forRSAkeys, or256,384, and521forECkeys. This property is required when using RSA keys.
- exportable Boolean
- Is this certificate exportable?
- key
Type String - Specifies the type of key. Possible values are
EC,EC-HSM,RSA,RSA-HSMandoct. - reuse
Key Boolean - Is the key reusable?
- curve String
- Specifies the curve to use when creating an
ECkey. Possible values areP-256,P-256K,P-384, andP-521. This field will be required in a future release ifkey_typeisECorEC-HSM. - key
Size Integer - The size of the key used in the certificate. Possible values include
2048,3072, and4096forRSAkeys, or256,384, and521forECkeys. This property is required when using RSA keys.
- exportable boolean
- Is this certificate exportable?
- key
Type string - Specifies the type of key. Possible values are
EC,EC-HSM,RSA,RSA-HSMandoct. - reuse
Key boolean - Is the key reusable?
- curve string
- Specifies the curve to use when creating an
ECkey. Possible values areP-256,P-256K,P-384, andP-521. This field will be required in a future release ifkey_typeisECorEC-HSM. - key
Size number - The size of the key used in the certificate. Possible values include
2048,3072, and4096forRSAkeys, or256,384, and521forECkeys. This property is required when using RSA keys.
- exportable bool
- Is this certificate exportable?
- key_
type str - Specifies the type of key. Possible values are
EC,EC-HSM,RSA,RSA-HSMandoct. - reuse_
key bool - Is the key reusable?
- curve str
- Specifies the curve to use when creating an
ECkey. Possible values areP-256,P-256K,P-384, andP-521. This field will be required in a future release ifkey_typeisECorEC-HSM. - key_
size int - The size of the key used in the certificate. Possible values include
2048,3072, and4096forRSAkeys, or256,384, and521forECkeys. This property is required when using RSA keys.
- exportable Boolean
- Is this certificate exportable?
- key
Type String - Specifies the type of key. Possible values are
EC,EC-HSM,RSA,RSA-HSMandoct. - reuse
Key Boolean - Is the key reusable?
- curve String
- Specifies the curve to use when creating an
ECkey. Possible values areP-256,P-256K,P-384, andP-521. This field will be required in a future release ifkey_typeisECorEC-HSM. - key
Size Number - The size of the key used in the certificate. Possible values include
2048,3072, and4096forRSAkeys, or256,384, and521forECkeys. This property is required when using RSA keys.
CertificateCertificatePolicyLifetimeAction, CertificateCertificatePolicyLifetimeActionArgs
- Action
Certificate
Certificate Policy Lifetime Action Action - A
actionblock as defined below. - Trigger
Certificate
Certificate Policy Lifetime Action Trigger - A
triggerblock as defined below.
- Action
Certificate
Certificate Policy Lifetime Action Action - A
actionblock as defined below. - Trigger
Certificate
Certificate Policy Lifetime Action Trigger - A
triggerblock as defined below.
- action
Certificate
Certificate Policy Lifetime Action Action - A
actionblock as defined below. - trigger
Certificate
Certificate Policy Lifetime Action Trigger - A
triggerblock as defined below.
- action
Certificate
Certificate Policy Lifetime Action Action - A
actionblock as defined below. - trigger
Certificate
Certificate Policy Lifetime Action Trigger - A
triggerblock as defined below.
- action
Certificate
Certificate Policy Lifetime Action Action - A
actionblock as defined below. - trigger
Certificate
Certificate Policy Lifetime Action Trigger - A
triggerblock as defined below.
- action Property Map
- A
actionblock as defined below. - trigger Property Map
- A
triggerblock as defined below.
CertificateCertificatePolicyLifetimeActionAction, CertificateCertificatePolicyLifetimeActionActionArgs
- Action
Type string - The Type of action to be performed when the lifetime trigger is triggerec. Possible values include
AutoRenewandEmailContacts.
- Action
Type string - The Type of action to be performed when the lifetime trigger is triggerec. Possible values include
AutoRenewandEmailContacts.
- action
Type String - The Type of action to be performed when the lifetime trigger is triggerec. Possible values include
AutoRenewandEmailContacts.
- action
Type string - The Type of action to be performed when the lifetime trigger is triggerec. Possible values include
AutoRenewandEmailContacts.
- action_
type str - The Type of action to be performed when the lifetime trigger is triggerec. Possible values include
AutoRenewandEmailContacts.
- action
Type String - The Type of action to be performed when the lifetime trigger is triggerec. Possible values include
AutoRenewandEmailContacts.
CertificateCertificatePolicyLifetimeActionTrigger, CertificateCertificatePolicyLifetimeActionTriggerArgs
- Days
Before intExpiry - The number of days before the Certificate expires that the action associated with this Trigger should run. Conflicts with
lifetime_percentage. - Lifetime
Percentage int - The percentage at which during the Certificates Lifetime the action associated with this Trigger should run. Conflicts with
days_before_expiry.
- Days
Before intExpiry - The number of days before the Certificate expires that the action associated with this Trigger should run. Conflicts with
lifetime_percentage. - Lifetime
Percentage int - The percentage at which during the Certificates Lifetime the action associated with this Trigger should run. Conflicts with
days_before_expiry.
- days
Before IntegerExpiry - The number of days before the Certificate expires that the action associated with this Trigger should run. Conflicts with
lifetime_percentage. - lifetime
Percentage Integer - The percentage at which during the Certificates Lifetime the action associated with this Trigger should run. Conflicts with
days_before_expiry.
- days
Before numberExpiry - The number of days before the Certificate expires that the action associated with this Trigger should run. Conflicts with
lifetime_percentage. - lifetime
Percentage number - The percentage at which during the Certificates Lifetime the action associated with this Trigger should run. Conflicts with
days_before_expiry.
- days_
before_ intexpiry - The number of days before the Certificate expires that the action associated with this Trigger should run. Conflicts with
lifetime_percentage. - lifetime_
percentage int - The percentage at which during the Certificates Lifetime the action associated with this Trigger should run. Conflicts with
days_before_expiry.
- days
Before NumberExpiry - The number of days before the Certificate expires that the action associated with this Trigger should run. Conflicts with
lifetime_percentage. - lifetime
Percentage Number - The percentage at which during the Certificates Lifetime the action associated with this Trigger should run. Conflicts with
days_before_expiry.
CertificateCertificatePolicySecretProperties, CertificateCertificatePolicySecretPropertiesArgs
- Content
Type string - The Content-Type of the Certificate, such as
application/x-pkcs12for a PFX orapplication/x-pem-filefor a PEM.
- Content
Type string - The Content-Type of the Certificate, such as
application/x-pkcs12for a PFX orapplication/x-pem-filefor a PEM.
- content
Type String - The Content-Type of the Certificate, such as
application/x-pkcs12for a PFX orapplication/x-pem-filefor a PEM.
- content
Type string - The Content-Type of the Certificate, such as
application/x-pkcs12for a PFX orapplication/x-pem-filefor a PEM.
- content_
type str - The Content-Type of the Certificate, such as
application/x-pkcs12for a PFX orapplication/x-pem-filefor a PEM.
- content
Type String - The Content-Type of the Certificate, such as
application/x-pkcs12for a PFX orapplication/x-pem-filefor a PEM.
CertificateCertificatePolicyX509CertificateProperties, CertificateCertificatePolicyX509CertificatePropertiesArgs
- Key
Usages List<string> - A list of uses associated with this Key. Possible values include
cRLSign,dataEncipherment,decipherOnly,digitalSignature,encipherOnly,keyAgreement,keyCertSign,keyEnciphermentandnonRepudiationand are case-sensitive. - Subject string
- The Certificate's Subject.
- Validity
In intMonths - The Certificates Validity Period in Months.
- Extended
Key List<string>Usages - A list of Extended/Enhanced Key Usages.
- Subject
Alternative CertificateNames Certificate Policy X509Certificate Properties Subject Alternative Names - A
subject_alternative_namesblock as defined below.
- Key
Usages []string - A list of uses associated with this Key. Possible values include
cRLSign,dataEncipherment,decipherOnly,digitalSignature,encipherOnly,keyAgreement,keyCertSign,keyEnciphermentandnonRepudiationand are case-sensitive. - Subject string
- The Certificate's Subject.
- Validity
In intMonths - The Certificates Validity Period in Months.
- Extended
Key []stringUsages - A list of Extended/Enhanced Key Usages.
- Subject
Alternative CertificateNames Certificate Policy X509Certificate Properties Subject Alternative Names - A
subject_alternative_namesblock as defined below.
- key
Usages List<String> - A list of uses associated with this Key. Possible values include
cRLSign,dataEncipherment,decipherOnly,digitalSignature,encipherOnly,keyAgreement,keyCertSign,keyEnciphermentandnonRepudiationand are case-sensitive. - subject String
- The Certificate's Subject.
- validity
In IntegerMonths - The Certificates Validity Period in Months.
- extended
Key List<String>Usages - A list of Extended/Enhanced Key Usages.
- subject
Alternative CertificateNames Certificate Policy X509Certificate Properties Subject Alternative Names - A
subject_alternative_namesblock as defined below.
- key
Usages string[] - A list of uses associated with this Key. Possible values include
cRLSign,dataEncipherment,decipherOnly,digitalSignature,encipherOnly,keyAgreement,keyCertSign,keyEnciphermentandnonRepudiationand are case-sensitive. - subject string
- The Certificate's Subject.
- validity
In numberMonths - The Certificates Validity Period in Months.
- extended
Key string[]Usages - A list of Extended/Enhanced Key Usages.
- subject
Alternative CertificateNames Certificate Policy X509Certificate Properties Subject Alternative Names - A
subject_alternative_namesblock as defined below.
- key_
usages Sequence[str] - A list of uses associated with this Key. Possible values include
cRLSign,dataEncipherment,decipherOnly,digitalSignature,encipherOnly,keyAgreement,keyCertSign,keyEnciphermentandnonRepudiationand are case-sensitive. - subject str
- The Certificate's Subject.
- validity_
in_ intmonths - The Certificates Validity Period in Months.
- extended_
key_ Sequence[str]usages - A list of Extended/Enhanced Key Usages.
- subject_
alternative_ Certificatenames Certificate Policy X509Certificate Properties Subject Alternative Names - A
subject_alternative_namesblock as defined below.
- key
Usages List<String> - A list of uses associated with this Key. Possible values include
cRLSign,dataEncipherment,decipherOnly,digitalSignature,encipherOnly,keyAgreement,keyCertSign,keyEnciphermentandnonRepudiationand are case-sensitive. - subject String
- The Certificate's Subject.
- validity
In NumberMonths - The Certificates Validity Period in Months.
- extended
Key List<String>Usages - A list of Extended/Enhanced Key Usages.
- subject
Alternative Property MapNames - A
subject_alternative_namesblock as defined below.
CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNames, CertificateCertificatePolicyX509CertificatePropertiesSubjectAlternativeNamesArgs
Import
Key Vault Certificates can be imported using the resource id, e.g.
$ pulumi import azure:keyvault/certificate:Certificate example "https://example-keyvault.vault.azure.net/certificates/example/fdf067c93bbb4b22bff4d8b7a9a56217"
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Azure Classic pulumi/pulumi-azure
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
azurermTerraform Provider.