证书是在Azure KeyVault中创建的。我需要从中下载公钥和私钥。

当内容类型是PEM时，我可以获取私钥并将其转换为RSA PrivateKey。

//when certificate is created with pem format, downloadedPK has both private and certificate sections
            //needs to extract the raw Private Key
            if ("application/x-pem-file".equalsIgnoreCase(privateKeyType)) {
                /*
                -----BEGIN PRIVATE KEY-----
                -----END PRIVATE KEY-----
                -----BEGIN CERTIFICATE-----
                -----END CERTIFICATE-----
                 */

当内容类型是PKCS12时，我不确定它是什么。

//when certificate is created with pkcs12 format, downloadedPK doesn't have any -----BEGIN * KEY-----
 //It's readable format similar to private key/certificate inside .pem file but without any "-----BEGIN *----- "

下面是我的代码：

ClientSecretCredential credential = new ClientSecretCredentialBuilder()
                .tenantId(tenantId)
                .clientId(clientId)
                .clientSecret(clientSecret)
                .build();

        CertificateClient certificateClient = new CertificateClientBuilder()
                .vaultUrl(vaultUri)
                .credential(credential)
                .buildClient();

        SecretClient secretClient = new SecretClientBuilder()
                .vaultUrl(vaultUri)
                .credential(credential)
                .buildClient();

        // Retrieving certificate
        KeyVaultCertificateWithPolicy certificateWithPolicy = certificateClient.getCertificate(alias);

        // Retrieving secrete for private key
        KeyVaultSecret secret = secretClient.getSecret(alias, certificateWithPolicy.getProperties().getVersion());
        
        String downloadedPK = secret.getValue();
        String privateKeyType = secret.getProperties().getContentType();

        byte[] rawPrivateKey = null;

            //when certificate is created with pem format, downloadedPK has both private and certificate sections
            //needs to extract the raw Private Key
            if ("application/x-pem-file".equalsIgnoreCase(privateKeyType)) {
                /*
                -----BEGIN PRIVATE KEY-----
                -----END PRIVATE KEY-----
                -----BEGIN CERTIFICATE-----
                -----END CERTIFICATE-----
                 */
                int endIndex = downloadedPK.indexOf("-----END PRIVATE KEY-----");
                String str1 = downloadedPK.substring(0, endIndex);

                privateKeyContent = str1.replaceAll("\\n", "").replace("-----BEGIN PRIVATE KEY-----", "");
            }

            //when certificate is created with pkcs12 format, downloadedPK doesn't have any -----BEGIN * KEY-----
            //It's readable format similar to private key/certificate inside .pem file but without any "-----BEGIN *----- "
            if ("application/x-pkcs12".equalsIgnoreCase(privateKeyType)) {

                //downloadedPK is "MIIKOAIBAzCCCfQGCSqGSIb3DQEHA...+1Q1jLj89b50AgIH0A==""
                privateKeyContent = downloadedPK;
            }

            rawPrivateKey = Base64.getDecoder().decode(privateKeyContent);

            KeyFactory kf = KeyFactory.getInstance("RSA");

            PKCS8EncodedKeySpec keySpecPKCS8 = new PKCS8EncodedKeySpec(Base64.getDecoder().decode(privateKeyContent));
            PrivateKey privateRsaKey = kf.generatePrivate(keySpecPKCS8);

我在这里查看了这篇关于. NET Certificate uploaded to Azure Key Vault has different content when downloading as a secret的帖子，它可以立即使用secret.value作为byte [] pfx。

// For PEM, you'll need to extract the base64-encoded message body.
// .NET 5.0 preview introduces the System.Security.Cryptography.PemEncoding class to make this easier.
if ("application/x-pkcs12".Equals(secret.Properties.ContentType, StringComparison.InvariantCultureIgnoreCase))
{
    byte[] pfx = Convert.FromBase64String(secret.Value);
    return new X509Certificate2(pfx);
}

但是我在java中下载的dPK是什么

MIIKOAIBAzCCCfQGCSqGSIb3DQEHA...+1Q1jLj89b50AgIH0A==

我得到了这个错误。这是否意味着我得到了pkcs12格式的私钥字符串？我该如何处理这个pkcs12字符串？

java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException : version mismatch: (supported:     00, parsed:     03
    at java.base/sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.java:251)
    at java.base/java.security.KeyFactory.generatePrivate(KeyFactory.java:390)