Azure.Security.KeyVault.Certificates 4.6.0

Prefix Reserved
dotnet add package Azure.Security.KeyVault.Certificates --version 4.6.0                
NuGet\Install-Package Azure.Security.KeyVault.Certificates -Version 4.6.0                
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.
<PackageReference Include="Azure.Security.KeyVault.Certificates" Version="4.6.0" />                
For projects that support PackageReference, copy this XML node into the project file to reference the package.
paket add Azure.Security.KeyVault.Certificates --version 4.6.0                
#r "nuget: Azure.Security.KeyVault.Certificates, 4.6.0"                
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.
// Install Azure.Security.KeyVault.Certificates as a Cake Addin
#addin nuget:?package=Azure.Security.KeyVault.Certificates&version=4.6.0

// Install Azure.Security.KeyVault.Certificates as a Cake Tool
#tool nuget:?package=Azure.Security.KeyVault.Certificates&version=4.6.0                

Azure Key Vault Certificate client library for .NET

Azure Key Vault is a cloud service that provides secure storage and automated management of certificates used throughout a cloud application. Multiple certificates, and multiple versions of the same certificate, can be kept in the Azure Key Vault. Each certificate in the vault has a policy associated with it which controls the issuance and lifetime of the certificate, along with actions to be taken as certificates near expiry.

The Azure Key Vault certificates client library enables programmatically managing certificates, offering methods to create, update, list, and delete certificates, policies, issuers, and contacts. The library also supports managing pending certificate operations and management of deleted certificates.

Source code | Package (NuGet) | API reference documentation | Product documentation | Samples | Migration guide

Getting started

Install the package

Install the Azure Key Vault certificates client library for .NET with NuGet:

dotnet add package Azure.Security.KeyVault.Certificates


  • An Azure subscription.
  • An existing Azure Key Vault. If you need to create an Azure Key Vault, you can use the Azure Portal or Azure CLI.
  • Authorization to an existing Azure Key Vault using either RBAC (recommended) or access control.

If you use the Azure CLI, replace <your-resource-group-name> and <your-key-vault-name> with your own, unique names:

az keyvault create --resource-group <your-resource-group-name> --name <your-key-vault-name>

Authenticate the client

In order to interact with the Azure Key Vault service, you'll need to create an instance of the CertificateClient class. You need a vault url, which you may see as "DNS Name" in the portal, and credentials to instantiate a client object.

The examples shown below use a DefaultAzureCredential, which is appropriate for most scenarios including local development and production environments. Additionally, we recommend using a managed identity for authentication in production environments. You can find more information on different ways of authenticating and their corresponding credential types in the Azure Identity documentation.

To use the DefaultAzureCredential provider shown below, or other credential providers provided with the Azure SDK, you must first install the Azure.Identity package:

dotnet add package Azure.Identity
Create CertificateClient

Instantiate a DefaultAzureCredential to pass to the client. The same instance of a token credential can be used with multiple clients if they will be authenticating with the same identity.

// Create a new certificate client using the default credential from Azure.Identity using environment variables previously set,
var client = new CertificateClient(vaultUri: new Uri(vaultUrl), credential: new DefaultAzureCredential());

Key concepts


A KeyVaultCertificate is the fundamental resource within Azure Key Vault. You'll use certificates to encrypt and verify encrypted or signed data.


With a CertificateClient you can get certificates from the vault, create new certificates and new versions of existing certificates, update certificate metadata, and delete certificates. You can also manage certificate issuers, contacts, and management policies of certificates. This is illustrated in the examples below.

Thread safety

We guarantee that all client instance methods are thread-safe and independent of each other (guideline). This ensures that the recommendation of reusing client instances is always safe, even across threads.

Additional concepts

Client options | Accessing the response | Long-running operations | Handling failures | Diagnostics | Mocking | Client lifetime


The Azure.Security.KeyVault.Certificates package supports synchronous and asynchronous APIs.

The following section provides several code snippets using the clientcreated above, covering some of the most common Azure Key Vault certificate service related tasks:

Sync examples

Async examples

Create a certificate

StartCreateCertificate creates a certificate to be stored in the Azure Key Vault. If a certificate with the same name already exists, then a new version of the certificate is created. When creating the certificate the user can specify the policy which controls the certificate lifetime. If no policy is specified the default policy will be used. The StartCreateCertificate operation returns a CertificateOperation. The following example creates a self-signed certificate with the default policy.

// Create a certificate. This starts a long running operation to create and sign the certificate.
CertificateOperation operation = client.StartCreateCertificate("MyCertificate", CertificatePolicy.Default);

// You can await the completion of the create certificate operation.
// You should run UpdateStatus in another thread or do other work like pumping messages between calls.
while (!operation.HasCompleted)


KeyVaultCertificateWithPolicy certificate = operation.Value;

NOTE: Depending on the certificate issuer and validation methods, certificate creation and signing can take an indeterminate amount of time. Users should only wait on certificate operations when the operation can be reasonably completed in the scope of the application, such as with self-signed certificates or issuers with well known response times.

Retrieve a certificate

GetCertificate retrieves the latest version of a certificate stored in the Azure Key Vault along with its CertificatePolicy.

KeyVaultCertificateWithPolicy certificateWithPolicy = client.GetCertificate("MyCertificate");

GetCertificateVersion retrieves a specific version of a certificate in the vault.

KeyVaultCertificate certificate = client.GetCertificateVersion(certificateWithPolicy.Name, certificateWithPolicy.Properties.Version);

Update an existing certificate

UpdateCertificate updates a certificate stored in the Azure Key Vault.

CertificateProperties certificateProperties = new CertificateProperties(certificate.Id);
certificateProperties.Tags["key1"] = "value1";

KeyVaultCertificate updated = client.UpdateCertificateProperties(certificateProperties);

List certificates

GetCertificates enumerates the certificates in the vault, returning select properties of the certificate. Sensitive fields of the certificate will not be returned. This operation requires the certificates/list permission.

Pageable<CertificateProperties> allCertificates = client.GetPropertiesOfCertificates();

foreach (CertificateProperties certificateProperties in allCertificates)

Delete a certificate

DeleteCertificate deletes all versions of a certificate stored in the Azure Key Vault. When soft-delete is not enabled for the Azure Key Vault, this operation permanently deletes the certificate. If soft delete is enabled the certificate is marked for deletion and can be optionally purged or recovered up until its scheduled purge date.

DeleteCertificateOperation operation = client.StartDeleteCertificate("MyCertificate");

// You only need to wait for completion if you want to purge or recover the certificate.
// You should call `UpdateStatus` in another thread or after doing additional work like pumping messages.
while (!operation.HasCompleted)


DeletedCertificate certificate = operation.Value;

Create a certificate asynchronously

The asynchronous APIs are identical to their synchronous counterparts, but return with the typical "Async" suffix for asynchronous methods and return a Task.

This example creates a certificate in the Azure Key Vault with the specified optional arguments.

// Create a certificate. This starts a long running operation to create and sign the certificate.
CertificateOperation operation = await client.StartCreateCertificateAsync("MyCertificate", CertificatePolicy.Default);

// You can await the completion of the create certificate operation.
KeyVaultCertificateWithPolicy certificate = await operation.WaitForCompletionAsync();

List certificates asynchronously

Listing certificate does not rely on awaiting the GetPropertiesOfCertificatesAsync method, but returns an AsyncPageable<CertificateProperties> that you can use with the await foreach statement:

AsyncPageable<CertificateProperties> allCertificates = client.GetPropertiesOfCertificatesAsync();

await foreach (CertificateProperties certificateProperties in allCertificates)

Delete a certificate asynchronously

When deleting a certificate asynchronously before you purge it, you can await the WaitForCompletionAsync method on the operation. By default, this loops indefinitely but you can cancel it by passing a CancellationToken.

DeleteCertificateOperation operation = await client.StartDeleteCertificateAsync("MyCertificate");

// You only need to wait for completion if you want to purge or recover the certificate.
await operation.WaitForCompletionAsync();

DeletedCertificate certificate = operation.Value;
await client.PurgeDeletedCertificateAsync(certificate.Name);


See our troubleshooting guide for details on how to diagnose various failure scenarios.


When you interact with the Azure Key Vault certificates client library using the .NET SDK, errors returned by the service correspond to the same HTTP status codes returned for REST API requests.

For example, if you try to retrieve a Key that doesn't exist in your Azure Key Vault, a 404 error is returned, indicating Not Found.

    KeyVaultCertificateWithPolicy certificateWithPolicy = client.GetCertificate("SomeCertificate");
catch (RequestFailedException ex)

You will notice that additional information is logged, like the Client Request ID of the operation.

    Azure.RequestFailedException : Service request failed.
    Status: 404 (Not Found)
    {"error":{"code":"CertificateNotFound","message":"Certificate not found: MyCertificate"}}

    Cache-Control: no-cache
    Pragma: no-cache
    Server: Microsoft-IIS/10.0
    x-ms-keyvault-region: westus
    x-ms-request-id: 625f870e-10ea-41e5-8380-282e5cf768f2
    x-ms-keyvault-network-info: addr=;act_addr_fam=InterNetwork;
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    Strict-Transport-Security: max-age=31536000;includeSubDomains
    X-Content-Type-Options: nosniff
    Date: Tue, 18 Jun 2019 16:02:11 GMT
    Content-Length: 75
    Content-Type: application/json; charset=utf-8
    Expires: -1

Next steps

Several Azure Key Vault certificates client library samples are available to you in this GitHub repository. These samples provide example code for additional scenarios commonly encountered while working with Azure Key Vault:

  • - for working with Azure Key Vault certificates, including:

    • Create a certificate
    • Get an existing certificate
    • Update an existing certificate
    • Delete a certificate
  • - Example code for working with Azure Key Vault certificates, including:

    • Create certificates
    • List all certificates in the Key Vault
    • List versions of a specified certificate
    • Delete certificates from the Key Vault
    • List deleted certificates in the Key Vault

Additional Documentation


See the for details on building, testing, and contributing to these libraries.

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact with any additional questions or comments.

Product Compatible and additional computed target framework versions.
.NET net5.0 was computed.  net5.0-windows was computed.  net6.0 was computed.  net6.0-android was computed.  net6.0-ios was computed.  net6.0-maccatalyst was computed.  net6.0-macos was computed.  net6.0-tvos was computed.  net6.0-windows was computed.  net7.0 was computed.  net7.0-android was computed.  net7.0-ios was computed.  net7.0-maccatalyst was computed.  net7.0-macos was computed.  net7.0-tvos was computed.  net7.0-windows was computed.  net8.0 was computed.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed. 
.NET Core netcoreapp2.0 was computed.  netcoreapp2.1 was computed.  netcoreapp2.2 was computed.  netcoreapp3.0 was computed.  netcoreapp3.1 was computed. 
.NET Standard netstandard2.0 is compatible.  netstandard2.1 was computed. 
.NET Framework net461 was computed.  net462 was computed.  net463 was computed.  net47 was computed.  net471 was computed.  net472 was computed.  net48 was computed.  net481 was computed. 
MonoAndroid monoandroid was computed. 
MonoMac monomac was computed. 
MonoTouch monotouch was computed. 
Tizen tizen40 was computed.  tizen60 was computed. 
Xamarin.iOS xamarinios was computed. 
Xamarin.Mac xamarinmac was computed. 
Xamarin.TVOS xamarintvos was computed. 
Xamarin.WatchOS xamarinwatchos was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages (54)

Showing the top 5 NuGet packages that depend on Azure.Security.KeyVault.Certificates:

Package Downloads

This package brings certificate management for MSAL.NET.


The AKEless Build System for C#/.NET Signed by from repository '' commit '011956b31c05f14f3233f6241cd6fbe038824d71' (see contained AppVeyorSettings.json file for build settings).


HealthChecks.AzureKeyVault is the health check package for Azure Key Vault secrets


Extensions to provide consistent configurations and patterns for your service.


Package chứa các constant và enum

GitHub repositories (23)

Showing the top 5 popular GitHub repositories that depend on Azure.Security.KeyVault.Certificates:

Repository Stars
This repository is for active development of the Azure SDK for .NET. For consumers of the SDK we recommend visiting our public developer docs at or our versioned developer docs at
A simple ACME client for Windows (for use with Let's Encrypt et al.)
Microsoft Azure PowerShell
Enterprise HealthChecks for ASP.NET Core Diagnostics Package
The administration for the IdentityServer4 and Asp.Net Core Identity
Version Downloads Last updated
4.6.0 3,660,330 2/15/2024
4.6.0-beta.2 5,588 11/13/2023
4.6.0-beta.1 136 11/10/2023
4.5.1 13,594,962 3/31/2023
4.5.0 388,532 3/14/2023
4.5.0-beta.1 9,482 11/9/2022
4.4.0 2,921,289 9/20/2022
4.3.0 3,619,730 3/26/2022
4.3.0-beta.4 18,263 1/13/2022
4.3.0-beta.2 12,067 10/14/2021
4.3.0-beta.1 175,589 8/11/2021
4.2.0 3,694,152 6/16/2021
4.2.0-beta.6 1,524 5/12/2021
4.2.0-beta.5 8,730 3/9/2021
4.2.0-beta.4 25,459 2/11/2021
4.2.0-beta.3 109,622 11/13/2020
4.2.0-beta.2 1,053 10/7/2020
4.2.0-beta.1 20,248 9/9/2020
4.1.0 59,011,476 8/12/2020
4.1.0-preview.1 38,978 3/10/2020
4.0.3 110,450 7/9/2020
4.0.2 1,226,300 4/4/2020
4.0.1 32,426 3/4/2020
4.0.0 106,478 1/9/2020
4.0.0-preview.8 551 12/20/2019
4.0.0-preview.7 826 12/4/2019
4.0.0-preview.6 690 11/1/2019
4.0.0-preview.5 1,174 10/8/2019
4.0.0-preview.4 459 9/11/2019