Pascal (Lazarus/Delphi)

Easy Method to Import Certificate to Azure Key Vault

See more Azure Key Vault Examples

Demonstrates an easier method to import certificate with private key to an Azure key vault.

Note: This example requires Chilkat v9.5.0.96 or later.

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Cert,
  Chilkat.JsonObject;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  cert: TCert;
  json: TJsonObject;
  jsonOut: TJsonObject;

begin
  success := False;

  cert := TCert.Create;

  //  The certificate must originate from a source where the private key material is available to be included
  //  in the upload to Azure Key Vault.

  success := cert.LoadPfxFile('qa_data/pfx/myCert.pfx','pfx_password');
  if (success = False) then
    begin
      WriteLn(cert.LastErrorText);
      Exit;
    end;

  json := TJsonObject.Create;

  //  Indicate this request is to upload to Azure Key Vault.
  json.UpdateString('service','azure-keyvault');

  //  Provide your OAuth2 client credentials for your Azure App (service principal) that has
  //  the required Role-Based Access Control (RBAC) permissions.
  json.UpdateString('auth.client_id','APP_ID');
  json.UpdateString('auth.client_secret','APP_PASSWORD');
  json.UpdateString('auth.tenant_id','TENANT_ID');

  //  Indicate the key vault name
  json.UpdateString('vault_name','VAULT_NAME');

  //  When you import a certificate into an Azure Key Vault, the certificate name and vault name are included as 
  //  parts of the URL to specify the target location where the certificate should be stored. 
  //  The URL follows a specific format to identify the target Key Vault and the certificate within it. 
  //  Here's how the certificate name and vault name are incorporated into the URL:
  //  https://VAULT_NAME.vault.azure.net//certificates/CERT_NAME/import?api-version=7.4

  //  Specify an arbitrary certificate name, but one that can be used in a URL as shown above.  (i.e. alphanumeric with no SPACE chars)
  json.UpdateString('cert_name','CERT_NAME');

  //  Add optional tags if desired. Tags can be anything you want.   
  json.UpdateString('tags.serial',cert.SerialNumber);
  json.UpdateString('tags.issuer',cert.IssuerCN);
  json.UpdateString('tags.subject',cert.SubjectCN);

  //  OK.. everything is specified.  Simply call UploadToCloud.
  jsonOut := TJsonObject.Create;
  jsonOut.EmitCompact := False;
  success := cert.UploadToCloud(json,jsonOut);
  if (success = False) then
    begin
      WriteLn(cert.LastErrorText);
      WriteLn(jsonOut.Emit());
      Exit;
    end;

  //  Success!  Go to the Azure portal and refresh to see the certificate has been uploaded.
  //  The jsonOut provides the JSON response from the Azure server.
  WriteLn(jsonOut.Emit());
  WriteLn('Success');

  //  Here is sample jsonOut

  //  {
  //    "id": "https://kvchilkat.vault.azure.net/certificates/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
  //    "kid": "https://kvchilkat.vault.azure.net/keys/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
  //    "sid": "https://kvchilkat.vault.azure.net/secrets/ChilkatTestCert123/b6e997db70144435a49d924be9f260ef",
  //    "x5t": "I_e3776K5Q_6PN1HHvJoI2ZGQRQ",
  //    "cer": "MIIGXjCCBMagAw ... z50cjTsi7yIY=",
  //    "attributes": {
  //      "enabled": true,
  //      "nbf": 1633996800,
  //      "exp": 1728691199,
  //      "created": 1697754785,
  //      "updated": 1697754785,
  //      "recoveryLevel": "CustomizedRecoverable+Purgeable",
  //      "recoverableDays": 7
  //    },
  //    "tags": {
  //      "serial": "3FF5B69109BFD4046C92CC0D18EE23C2",
  //      "issuer": "Sectigo Public Code Signing CA R36",
  //      "subject": "Chilkat Software, Inc."
  //    },
  //    "policy": {
  //      "id": "https://kvchilkat.vault.azure.net/certificates/ChilkatTestCert123/policy",
  //      "key_props": {
  //        "exportable": true,
  //        "kty": "RSA",
  //        "key_size": 4096,
  //        "reuse_key": false
  //      },
  //      "secret_props": {
  //        "contentType": "application/x-pkcs12"
  //      },
  //      "x509_props": {
  //        "subject": "CN=\"Chilkat Software, Inc.\", O=\"Chilkat Software, Inc.\", S=Illinois, C=US",
  //        "ekus": [
  //          "1.3.6.1.5.5.7.3.3"
  //        ],
  //        "key_usage": [
  //          "digitalSignature"
  //        ],
  //        "validity_months": 37,
  //        "basic_constraints": {
  //          "ca": false
  //        }
  //      },
  //      "lifetime_actions": [
  //        {
  //          "trigger": {
  //            "lifetime_percentage": 80
  //          },
  //          "action": {
  //            "action_type": "EmailContacts"
  //          }
  //        }
  //      ],
  //      "issuer": {
  //        "name": "Unknown"
  //      },
  //      "attributes": {
  //        "enabled": true,
  //        "created": 1697754785,
  //        "updated": 1697754785
  //      }
  //    }
  //  }


  cert.Free;
  json.Free;
  jsonOut.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.