Azure Keyvault Certificates Rust

1---
2name: azure-keyvault-certificates-rust
3description: |
4  Azure Key Vault Certificates SDK for Rust. Use for creating, importing, and managing certificates.
5  Triggers: "keyvault certificates rust", "CertificateClient rust", "create certificate rust", "import certificate rust".
6package: azure_security_keyvault_certificates
7---
8 
9# Azure Key Vault Certificates SDK for Rust
10 
11Client library for Azure Key Vault Certificates — secure storage and management of certificates.
12 
13## Installation
14 
15```sh
16cargo add azure_security_keyvault_certificates azure_identity
17```
18 
19## Environment Variables
20 
21```bash
22AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/
23```
24 
25## Authentication
26 
27```rust
28use azure_identity::DeveloperToolsCredential;
29use azure_security_keyvault_certificates::CertificateClient;
30 
31let credential = DeveloperToolsCredential::new(None)?;
32let client = CertificateClient::new(
33    "https://<vault-name>.vault.azure.net/",
34    credential.clone(),
35    None,
36)?;
37```
38 
39## Core Operations
40 
41### Get Certificate
42 
43```rust
44use azure_core::base64;
45 
46let certificate = client
47    .get_certificate("certificate-name", None)
48    .await?
49    .into_model()?;
50 
51println!(
52    "Thumbprint: {:?}",
53    certificate.x509_thumbprint.map(base64::encode_url_safe)
54);
55```
56 
57### Create Certificate
58 
59```rust
60use azure_security_keyvault_certificates::models::{
61    CreateCertificateParameters, CertificatePolicy,
62    IssuerParameters, X509CertificateProperties,
63};
64 
65let policy = CertificatePolicy {
66    issuer_parameters: Some(IssuerParameters {
67        name: Some("Self".into()),
68        ..Default::default()
69    }),
70    x509_certificate_properties: Some(X509CertificateProperties {
71        subject: Some("CN=example.com".into()),
72        ..Default::default()
73    }),
74    ..Default::default()
75};
76 
77let params = CreateCertificateParameters {
78    certificate_policy: Some(policy),
79    ..Default::default()
80};
81 
82let operation = client
83    .create_certificate("cert-name", params.try_into()?, None)
84    .await?;
85```
86 
87### Import Certificate
88 
89```rust
90use azure_security_keyvault_certificates::models::ImportCertificateParameters;
91 
92let params = ImportCertificateParameters {
93    base64_encoded_certificate: Some(base64_cert_data),
94    password: Some("optional-password".into()),
95    ..Default::default()
96};
97 
98let certificate = client
99    .import_certificate("cert-name", params.try_into()?, None)
100    .await?
101    .into_model()?;
102```
103 
104### Delete Certificate
105 
106```rust
107client.delete_certificate("certificate-name", None).await?;
108```
109 
110### List Certificates
111 
112```rust
113use azure_security_keyvault_certificates::ResourceExt;
114use futures::TryStreamExt;
115 
116let mut pager = client.list_certificate_properties(None)?.into_stream();
117while let Some(cert) = pager.try_next().await? {
118    let name = cert.resource_id()?.name;
119    println!("Certificate: {}", name);
120}
121```
122 
123### Get Certificate Policy
124 
125```rust
126let policy = client
127    .get_certificate_policy("certificate-name", None)
128    .await?
129    .into_model()?;
130```
131 
132### Update Certificate Policy
133 
134```rust
135use azure_security_keyvault_certificates::models::UpdateCertificatePolicyParameters;
136 
137let params = UpdateCertificatePolicyParameters {
138    // Update policy properties
139    ..Default::default()
140};
141 
142client
143    .update_certificate_policy("cert-name", params.try_into()?, None)
144    .await?;
145```
146 
147## Certificate Lifecycle
148 
1491. **Create** — generates new certificate with policy
1502. **Import** — import existing PFX/PEM certificate
1513. **Get** — retrieve certificate (public key only)
1524. **Update** — modify certificate properties
1535. **Delete** — soft delete (recoverable)
1546. **Purge** — permanent deletion
155 
156## Best Practices
157 
1581. **Use Entra ID auth** — `DeveloperToolsCredential` for dev
1592. **Use managed certificates** — auto-renewal with supported issuers
1603. **Set proper validity period** — balance security and maintenance
1614. **Use certificate policies** — define renewal and key properties
1625. **Monitor expiration** — set up alerts for expiring certificates
1636. **Enable soft delete** — required for production vaults
164 
165## RBAC Permissions
166 
167Assign these Key Vault roles:
168- `Key Vault Certificates Officer` — full CRUD on certificates
169- `Key Vault Reader` — read certificate metadata
170 
171## Reference Links
172 
173| Resource | Link |
174|----------|------|
175| API Reference | https://docs.rs/azure_security_keyvault_certificates |
176| Source Code | https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_certificates |
177| crates.io | https://crates.io/crates/azure_security_keyvault_certificates |
178