In Azure Key Vault when creating a CSR certificate. Where is the private key to be found?

Question

In Azure Key Vault when creating a CSR certificate. Where is the private key to be found?

A CSR Certificate is required by our CA SSL provider, but in order to create a PFX file using openssl I need a private key. No longer issued by our CA. I am told the private key should be in the azure key vault. But was not created with the CSR file. Where else in Azure or in the Key Vault is the private key located?

Answer 1

When you create a Certificate Signing Request (CSR) from Azure Key Vault, the private key is generated and stored securely within Azure Key Vault, but it is not exportable unless you explicitly configure the key as exportable when you create the CSR.

More specifically, when you create a CSR in Azure Key Vault using the BeginCreateCertificate method with a CertificatePolicy, Azure Key Vault generates a key pair (private and public keys). The private key is stored securely in the Key Vault's HSM-backed or software-protected storage. Only the public part of the key is used to generate the CSR.

Effecively, you can't download the private key by default from Azure Key Vault. This is by design to keep the private key secure. The CSR can be exported, submitted to your CA, and when the CA returns the signed certificate, you merge it back into Key Vault — but the private key never leaves the vault.

To create a .pfx (which includes both the certificate and the private key), you need to make key exportable and use Azure to export PFX

1. When creating the certificate (or CSR), set exportable: true in the certificate policy:

      "key_properties": {
        "exportable": true,
        "key_type": "RSA",
        "key_size": 2048
      }
   

2. After the CA returns the signed certificate and you merge it into Azure Key Vault, you can then:
   • Use the Azure CLI or PowerShell to download the full certificate including the private key:

          az keyvault certificate download \
            --vault-name <vault-name> \
            --name <cert-name> \
            --file cert.pfx \
            --encoding PFX
     

3. You now have a .pfx file with the private key.

If the certificate was not created as exportable then unfortunately the private key is locked inside the Key Vault, you cannot extract it, and cannot create a .pfx using openssl. so your only option is to recreate the certificate, this time ensuring it is marked as exportable.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin