Cloud

Azure Key Vault is a convenient place to store and manage SSL/TLS certificates, but there are times when you need to take a certificate out of Key Vault and use it somewhere else. For example, you may need to export a certificate as a PFX (.pfx) file so that it can be installed on a Windows server, imported into IIS, configured on another application, or transferred to a system that cannot retrieve certificates directly from Azure Key Vault. In this guide, I’ll show you how to export a certificate from Azure Key Vault using PowerShell, including how to protect the resulting PFX file with a password. Before you start There is an important limitation to be aware of before attempting to export a certificate. The certificate’s private key must have been created as exportable. When a certificate is created in Azure Key Vault, its certificate policy determines whether the private key can be exported. If the certificate was created with a non-exportable private key, you cannot simply change the setting later and export the private key. Microsoft also notes that exportable keys are supported for RSA and EC keys, while HSM-backed keys are non-exportable. This distinction is important because downloading the certificate itself is not necessarily the same as exporting the private key. A certificate without its private key is generally not sufficient when you need to install it on another server. What is stored in Azure Key Vault? When you create a certificate in Azure Key Vault, Key Vault maintains several related objects. The certificate contains the X.509 certificate information, while an associated secret contains the certificate value. When the certificate is exportable, the secret can contain the certificate together with its private key. This is why the PowerShell method below retrieves the secret rather than simply downloading the certificate. What you will need You’ll need: If you are using a workstation with the Az PowerShell modules installed, you can first authenticate with: If you have multiple Azure subscriptions, make sure you are working in the correct one: You can change subscriptions with: Export the certificate as a PFX The simplest approach is to retrieve the certificate’s associated secret, decode the Base64 value and write it to a .pfx file. For example: Microsoft documents this approach for exporting the certificate and private key from Key Vault. At this point you should have: However, there is an important detail with this method. The exported PFX may not have the password you want The certificate value stored by Key Vault can be retrieved as a PFX, but if you need to provide the certificate to another administrator or application, you may want to create a new password-protected PFX. That’s where the following approach is useful. Export the certificate and apply a new PFX password The following script retrieves the certificate from Key Vault, loads it with its private key and then exports it again as a password-protected PFX. This produces a PFX file protected by the password you specify. Why retrieve the secret instead of the certificate? This is one of the slightly confusing aspects of Azure Key Vault. If you run: you are retrieving the Key Vault certificate object and its metadata. That includes information such as: The private key isn’t exposed directly through the certificate object. The associated Key Vault secret is what contains the certificate value that can include the private key when the certificate is exportable. That’s why the export process ultimately uses: rather than only: Verify the PFX file Before copying the certificate to another server, it’s a good idea to verify that the PFX contains the private key. On Windows, you can use PowerShell: You want: for: You can also inspect the certificate using the Windows certificate import wizard. Right-click the .pfx file and select Install PFX. During the import process, Windows will ask for the password you assigned to the PFX. Exporting through the Azure Portal You don’t necessarily need PowerShell. Azure Key Vault also provides certificate download options through the Azure portal. Navigate to: Azure Portal → Key Vault → Certificates → Your Certificate → Current Version Depending on the certificate and configuration, you can use the download option to obtain the certificate in formats such as CER or PFX/PEM. The portal is convenient for a one-off export, while PowerShell is much more useful if you need to repeat the process or incorporate it into an administrative workflow. One thing to be aware of is that Azure Key Vault does not retain a certificate import password for later export. Microsoft states that when a certificate is exported from Key Vault, the export password is blank; if you need a PFX protected with a specific password, you can re-export it with PowerShell as shown above. What if the private key is missing? If the resulting certificate doesn’t contain a private key, the first thing to check is whether the Key Vault certificate was created as exportable. You can inspect the certificate in the Azure portal and review its configuration. If the certificate was created with a non-exportable private key, Azure Key Vault will not provide the private key when the certificate is retrieved as a secret. Unfortunately, you cannot turn a non-exportable private key into an exportable one after the fact. In that situation, you may need to create or import a new certificate with an exportable private key, depending on your security requirements. Security considerations A PFX file containing a private key should be treated as a sensitive credential. Once you export it from Key Vault: This is particularly important because one of the advantages of Azure Key Vault is that applications can use certificates without requiring administrators to distribute private-key files manually. Microsoft recommends limiting who can export certificates containing private keys and auditing certificate access and export operations. Azure CLI alternative If you prefer Azure CLI, you can retrieve the certificate’s public portion with: However, that downloads the public portion of the certificate. To retrieve the certificate including its private