Store Private Key into Azure KeyVault, value got changed

Question

I tried to store my private key to Azure Key Vault, but when I retrieve it out, my private key got changed.

If I put the private key into my web.config file, it works without any issue.

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAohoZ+TCXMn17BPFXFCuIHvh7oONSBNCjuixl2CbwrGO8tIAO
XIQP1sZa3lhXkUj0f4HewmYsx6JR+39Do21H+QtCZxR4qCvOJxrrFHqMrk76aQji
....
ZVmUljOatig+g+q+jMEf7IA5zcAgBdAAuausXrPoNcip89Yuqag1
-----END RSA PRIVATE KEY-----

Since my private key is just a text, I stored it as a Secrets. Am I doing the right thing?

I also tried to store the key as a Certificate, but the key is just a text with hidden CRLN, it is not PEM or PKCS#12. And in my case, I don't need to store the public key.

Below is my code to retrieve the key:

public static string GetDocuSignPrivateKey()
{
    var key = keyVaultClient.GetSecretAsync($"{vaultUrl}secrets/DocuSignPrivateKey/88e15b41234bf89619ddc9a2exxxx").Result;

    return key.Value;
}

Sorry, I just start using Azure KeyVault. Please help. Thank you.

It's oddly. I test in my site and it works well. Do you ensure your secret identifier is correctly? — Joey Cai, May 03 '19 at 07:16
There should not be any issue in storing plain text. I do want to ask if you put the key into the vault using the portal, powershell or code. There's a known problem that the portal does not preserve formatting of the secret. Powershell will preserve the formatting. — Matt Small, May 03 '19 at 13:53

score 3 · Accepted Answer · answered May 07 '19 at 15:17

Thanks to @Matt Small 's response. I use Azure Cloud Shell to enter the private key and it works.

$secretvalue = ConvertTo-SecureString 'priKey here' -AsPlainText -Force

$secret = Set-AzKeyVaultSecret -VaultName 'vaultName' -Name 'secretName' -SecretValue $secretvalue

score 0 · Answer 2 · answered Feb 11 '22 at 08:19

This is how I deployed a private key from a .ppk file to the keyvault using powershell. The first one is in nonproduction where I used AAD MFA, the second one is in production where I used a service principal.

AAD Multifactor Log In

Connect-AzAccount -DeviceCode

$fileContentInBvtes = get-content C:\Users\filedirectory\file.ppk -Encoding Byte
$fileContentAsBase64 = [Svstem.Convert]::ToBase64String($fileContentInBytes)

Set-AzKeyVaultSecret -VaultName 'CHANGEVALUETOKEYVAULTNAME' -SecretName 'CHANGEVALUETOSECRETNAME' -SecretValue (ConvertTo-SecureString -String $fileContentAsBase64 -force -AsPlainText) -ErrorAction Stop

Service Principal

$secPassword = ConvertTo-SecureString -AsPlainText -Force -String 'CHANGEVALUETOSERVICEPRINCIPALPASSWORD'
$Applicationld= 'CHANGEVALUETOSERVICEPRINCIPALID'

$Credential = New-Object -TypeName Svstem.Management.Automation.PSCredential -Argumentlist $Applicationld, $secPassword

Connect-AzAccount -ServicePrincipal -Tenantld 'CHANGEVALUETOTENANTID' -Credential $Credential

$fileContentInBvtes = get-content C:\Users\filedirectory\file.ppk -Encoding Byte

$fileContentAsBase64 = [Svstem.Convert]::ToBase64String($fileContentInBytes)

Set-AzKeyVaultSecret -VaultName 'CHANGEVALUETOKEYVAULTNAME' -SecretName 'CHANGEVALUETOSECRETNAME' -SecretValue (ConvertTo-SecureString -String $fileContentAsBase64 -force -AsPlainText) -ErrorAction Stop

score 0 · Answer 3 · answered Mar 26 '22 at 16:23

Added the private Key to Azure using below method in C# instead of adding manually, then use Get Secret Method:

string secretName = "pKey";
string secretValue = "-----BEGIN ENCRYPTED PRIVATE KEY----\nMII9w0BBQ\nzZ8=\n-----END ENCRYPTED PRIVATE KEY-----\n";
Task addKey = client.SetSecretAsync(secretName, secretValue);
addKey.Wait();

SecretClient client = new SecretClient(new Uri(kvUri), new DefaultAzureCredential(),options);
KeyVaultSecret pKey = OKTAclient.GetSecret("pKey");                
string privateKey = pKey.Value;

score 0 · Answer 4 · answered Sep 30 '22 at 16:05

I had a similar problem where I was trying to add a private cert to the key vault by creating a secret. I used powershell and the following code snippet to make it to work.

I navigated to the folder where your private cert is located and then I applied:

az login

az keyvault secret set --name privateCert --vault-name mykeyvault-qa-kv --file .\private.key

Store Private Key into Azure KeyVault, value got changed

4 Answers4

Linked