你当前正在访问 Microsoft Azure Global Edition 技术文档网站。 如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

Certificate - Create Or Update

Service:

API Management

API Version:

2022-08-01

创建或更新用于在后端进行身份验证的证书。

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/certificates/{certificateId}?api-version=2022-08-01

URI 参数

名称	在	必需	类型	说明
certificateId	path	True	string	证书实体的标识符。 在当前API 管理服务实例中必须是唯一的。 Regex pattern: ^[^*#&+:<>?]+$
resourceGroupName	path	True	string	资源组的名称。 此名称不区分大小写。
serviceName	path	True	string	API 管理服务的名称。 Regex pattern: ^[a-zA-Z](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?$
subscriptionId	path	True	string	目标订阅的 ID。
api-version	query	True	string	要用于此操作的 API 版本。

请求头

名称	必需	类型	说明
If-Match		string	实体的 ETag。 创建实体时不需要，但在更新实体时是必需的。

请求正文

名称	类型	说明
properties.data	string	使用 application/x-pkcs12 表示形式的 Base 64 编码证书。
properties.keyVault	KeyVaultContractCreateProperties	证书的 KeyVault 位置详细信息。
properties.password	string	证书的密码

响应

名称	类型	说明
200 OK	CertificateContract	已成功更新证书详细信息。 Headers ETag: string
201 Created	CertificateContract	新证书已成功添加。 Headers ETag: string
Other Status Codes	ErrorResponse	描述操作失败原因的错误响应。

安全性

azure_auth

Azure Active Directory OAuth2 流。

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

名称	说明
user_impersonation	模拟用户帐户

示例

ApiManagementCreateCertificate

ApiManagementCreateCertificateWithKeyVault

ApiManagementCreateCertificate

Sample Request

HTTP

PUT https://management.azure.com/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ApiManagement/service/apimService1/certificates/tempcert?api-version=2022-08-01

{
  "properties": {
    "data": "****************Base 64 Encoded Certificate *******************************",
    "password": "****Certificate Password******"
  }
}

Java

/** Samples for Certificate CreateOrUpdate. */
public final class Main {
    /*
     * x-ms-original-file: specification/apimanagement/resource-manager/Microsoft.ApiManagement/stable/2022-08-01/examples/ApiManagementCreateCertificate.json
     */
    /**
     * Sample code: ApiManagementCreateCertificate.
     *
     * @param manager Entry point to ApiManagementManager.
     */
    public static void apiManagementCreateCertificate(
        com.azure.resourcemanager.apimanagement.ApiManagementManager manager) {
        manager
            .certificates()
            .define("tempcert")
            .withExistingService("rg1", "apimService1")
            .withData("****************Base 64 Encoded Certificate *******************************")
            .withPassword("****Certificate Password******")
            .create();
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Python

from typing import Any, IO, Union

from azure.identity import DefaultAzureCredential

from azure.mgmt.apimanagement import ApiManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-apimanagement
# USAGE
    python api_management_create_certificate.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = ApiManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="subid",
    )

    response = client.certificate.create_or_update(
        resource_group_name="rg1",
        service_name="apimService1",
        certificate_id="tempcert",
        parameters={
            "properties": {
                "data": "****************Base 64 Encoded Certificate *******************************",
                "password": "****Certificate Password******",
            }
        },
    )
    print(response)


# x-ms-original-file: specification/apimanagement/resource-manager/Microsoft.ApiManagement/stable/2022-08-01/examples/ApiManagementCreateCertificate.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armapimanagement_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/apimanagement/armapimanagement/v2"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/4cd95123fb961c68740565a1efcaa5e43bd35802/specification/apimanagement/resource-manager/Microsoft.ApiManagement/stable/2022-08-01/examples/ApiManagementCreateCertificate.json
func ExampleCertificateClient_CreateOrUpdate_apiManagementCreateCertificate() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armapimanagement.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewCertificateClient().CreateOrUpdate(ctx, "rg1", "apimService1", "tempcert", armapimanagement.CertificateCreateOrUpdateParameters{
		Properties: &armapimanagement.CertificateCreateOrUpdateProperties{
			Data:     to.Ptr("****************Base 64 Encoded Certificate *******************************"),
			Password: to.Ptr("****Certificate Password******"),
		},
	}, &armapimanagement.CertificateClientCreateOrUpdateOptions{IfMatch: nil})
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.CertificateContract = armapimanagement.CertificateContract{
	// 	Name: to.Ptr("tempcert"),
	// 	Type: to.Ptr("Microsoft.ApiManagement/service/certificates"),
	// 	ID: to.Ptr("/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ApiManagement/service/apimService1/certificates/tempcert"),
	// 	Properties: &armapimanagement.CertificateContractProperties{
	// 		ExpirationDate: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2018-03-17T21:55:07.000Z"); return t}()),
	// 		Subject: to.Ptr("CN=contoso.com"),
	// 		Thumbprint: to.Ptr("*******************3"),
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { ApiManagementClient } = require("@azure/arm-apimanagement");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Creates or updates the certificate being used for authentication with the backend.
 *
 * @summary Creates or updates the certificate being used for authentication with the backend.
 * x-ms-original-file: specification/apimanagement/resource-manager/Microsoft.ApiManagement/stable/2022-08-01/examples/ApiManagementCreateCertificate.json
 */
async function apiManagementCreateCertificate() {
  const subscriptionId = process.env["APIMANAGEMENT_SUBSCRIPTION_ID"] || "subid";
  const resourceGroupName = process.env["APIMANAGEMENT_RESOURCE_GROUP"] || "rg1";
  const serviceName = "apimService1";
  const certificateId = "tempcert";
  const parameters = {
    data: "****************Base 64 Encoded Certificate *******************************",
    password: "****Certificate Password******",
  };
  const credential = new DefaultAzureCredential();
  const client = new ApiManagementClient(credential, subscriptionId);
  const result = await client.certificate.createOrUpdate(
    resourceGroupName,
    serviceName,
    certificateId,
    parameters
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample Response

Status code:

201

{
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ApiManagement/service/apimService1/certificates/tempcert",
  "type": "Microsoft.ApiManagement/service/certificates",
  "name": "tempcert",
  "properties": {
    "subject": "CN=contoso.com",
    "thumbprint": "*******************3",
    "expirationDate": "2018-03-17T21:55:07+00:00"
  }
}

Status code:

200

{
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ApiManagement/service/apimService1/certificates/tempcert",
  "type": "Microsoft.ApiManagement/service/certificates",
  "name": "tempcert",
  "properties": {
    "subject": "CN=contoso.com",
    "thumbprint": "*******************3",
    "expirationDate": "2018-03-17T21:55:07+00:00"
  }
}

ApiManagementCreateCertificateWithKeyVault

Sample Request

HTTP

PUT https://management.azure.com/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ApiManagement/service/apimService1/certificates/templateCertkv?api-version=2022-08-01

{
  "properties": {
    "keyVault": {
      "identityClientId": "ceaa6b06-c00f-43ef-99ac-f53d1fe876a0",
      "secretIdentifier": "https://rpbvtkeyvaultintegration.vault-int.azure-int.net/secrets/msitestingCert"
    }
  }
}

Java

import com.azure.resourcemanager.apimanagement.models.KeyVaultContractCreateProperties;

/** Samples for Certificate CreateOrUpdate. */
public final class Main {
    /*
     * x-ms-original-file: specification/apimanagement/resource-manager/Microsoft.ApiManagement/stable/2022-08-01/examples/ApiManagementCreateCertificateWithKeyVault.json
     */
    /**
     * Sample code: ApiManagementCreateCertificateWithKeyVault.
     *
     * @param manager Entry point to ApiManagementManager.
     */
    public static void apiManagementCreateCertificateWithKeyVault(
        com.azure.resourcemanager.apimanagement.ApiManagementManager manager) {
        manager
            .certificates()
            .define("templateCertkv")
            .withExistingService("rg1", "apimService1")
            .withKeyVault(
                new KeyVaultContractCreateProperties()
                    .withSecretIdentifier("fakeTokenPlaceholder")
                    .withIdentityClientId("ceaa6b06-c00f-43ef-99ac-f53d1fe876a0"))
            .create();
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Python

from typing import Any, IO, Union

from azure.identity import DefaultAzureCredential

from azure.mgmt.apimanagement import ApiManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-apimanagement
# USAGE
    python api_management_create_certificate_with_key_vault.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = ApiManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="subid",
    )

    response = client.certificate.create_or_update(
        resource_group_name="rg1",
        service_name="apimService1",
        certificate_id="templateCertkv",
        parameters={
            "properties": {
                "keyVault": {
                    "identityClientId": "ceaa6b06-c00f-43ef-99ac-f53d1fe876a0",
                    "secretIdentifier": "https://rpbvtkeyvaultintegration.vault-int.azure-int.net/secrets/msitestingCert",
                }
            }
        },
    )
    print(response)


# x-ms-original-file: specification/apimanagement/resource-manager/Microsoft.ApiManagement/stable/2022-08-01/examples/ApiManagementCreateCertificateWithKeyVault.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Go

package armapimanagement_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/apimanagement/armapimanagement/v2"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/4cd95123fb961c68740565a1efcaa5e43bd35802/specification/apimanagement/resource-manager/Microsoft.ApiManagement/stable/2022-08-01/examples/ApiManagementCreateCertificateWithKeyVault.json
func ExampleCertificateClient_CreateOrUpdate_apiManagementCreateCertificateWithKeyVault() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armapimanagement.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	res, err := clientFactory.NewCertificateClient().CreateOrUpdate(ctx, "rg1", "apimService1", "templateCertkv", armapimanagement.CertificateCreateOrUpdateParameters{
		Properties: &armapimanagement.CertificateCreateOrUpdateProperties{
			KeyVault: &armapimanagement.KeyVaultContractCreateProperties{
				IdentityClientID: to.Ptr("ceaa6b06-c00f-43ef-99ac-f53d1fe876a0"),
				SecretIdentifier: to.Ptr("https://rpbvtkeyvaultintegration.vault-int.azure-int.net/secrets/msitestingCert"),
			},
		},
	}, &armapimanagement.CertificateClientCreateOrUpdateOptions{IfMatch: nil})
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.CertificateContract = armapimanagement.CertificateContract{
	// 	Name: to.Ptr("templateCertkv"),
	// 	Type: to.Ptr("Microsoft.ApiManagement/service/certificates"),
	// 	ID: to.Ptr("/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ApiManagement/service/apimService1/certificates/templateCertkv"),
	// 	Properties: &armapimanagement.CertificateContractProperties{
	// 		ExpirationDate: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2037-01-01T07:00:00.000Z"); return t}()),
	// 		KeyVault: &armapimanagement.KeyVaultContractProperties{
	// 			IdentityClientID: to.Ptr("ceaa6b06-c00f-43ef-99ac-f53d1fe876a0"),
	// 			SecretIdentifier: to.Ptr("https://rpbvtkeyvaultintegration.vault-int.azure-int.net/secrets/msitestingCert"),
	// 			LastStatus: &armapimanagement.KeyVaultLastAccessStatusContractProperties{
	// 				Code: to.Ptr("Success"),
	// 				TimeStampUTC: to.Ptr(func() time.Time { t, _ := time.Parse(time.RFC3339Nano, "2020-09-22T00:24:53.319Z"); return t}()),
	// 			},
	// 		},
	// 		Subject: to.Ptr("CN=*.msitesting.net"),
	// 		Thumbprint: to.Ptr("EA**********************9AD690"),
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

JavaScript

const { ApiManagementClient } = require("@azure/arm-apimanagement");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Creates or updates the certificate being used for authentication with the backend.
 *
 * @summary Creates or updates the certificate being used for authentication with the backend.
 * x-ms-original-file: specification/apimanagement/resource-manager/Microsoft.ApiManagement/stable/2022-08-01/examples/ApiManagementCreateCertificateWithKeyVault.json
 */
async function apiManagementCreateCertificateWithKeyVault() {
  const subscriptionId = process.env["APIMANAGEMENT_SUBSCRIPTION_ID"] || "subid";
  const resourceGroupName = process.env["APIMANAGEMENT_RESOURCE_GROUP"] || "rg1";
  const serviceName = "apimService1";
  const certificateId = "templateCertkv";
  const parameters = {
    keyVault: {
      identityClientId: "ceaa6b06-c00f-43ef-99ac-f53d1fe876a0",
      secretIdentifier:
        "https://rpbvtkeyvaultintegration.vault-int.azure-int.net/secrets/msitestingCert",
    },
  };
  const credential = new DefaultAzureCredential();
  const client = new ApiManagementClient(credential, subscriptionId);
  const result = await client.certificate.createOrUpdate(
    resourceGroupName,
    serviceName,
    certificateId,
    parameters
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample Response

Status code:

201

{
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ApiManagement/service/apimService1/certificates/templateCertkv",
  "type": "Microsoft.ApiManagement/service/certificates",
  "name": "templateCertkv",
  "properties": {
    "subject": "CN=*.msitesting.net",
    "thumbprint": "EA**********************9AD690",
    "expirationDate": "2037-01-01T07:00:00Z",
    "keyVault": {
      "secretIdentifier": "https://rpbvtkeyvaultintegration.vault-int.azure-int.net/secrets/msitestingCert",
      "identityClientId": "ceaa6b06-c00f-43ef-99ac-f53d1fe876a0",
      "lastStatus": {
        "code": "Success",
        "timeStampUtc": "2020-09-22T00:24:53.3191468Z"
      }
    }
  }
}

Status code:

200

{
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.ApiManagement/service/apimService1/certificates/templateCertkv",
  "type": "Microsoft.ApiManagement/service/certificates",
  "name": "templateCertkv",
  "properties": {
    "subject": "CN=*.msitesting.net",
    "thumbprint": "EA**********************9AD690",
    "expirationDate": "2037-01-01T07:00:00Z",
    "keyVault": {
      "secretIdentifier": "https://rpbvtkeyvaultintegration.vault-int.azure-int.net/secrets/msitestingCert",
      "identityClientId": "ceaa6b06-c00f-43ef-99ac-f53d1fe876a0",
      "lastStatus": {
        "code": "Success",
        "timeStampUtc": "2020-09-22T00:24:53.3191468Z"
      }
    }
  }
}

定义

名称	说明
CertificateContract	证书详细信息。
CertificateCreateOrUpdateParameters	证书创建或更新详细信息。
ErrorFieldContract	错误字段协定。
ErrorResponse	错误响应。
KeyVaultContractCreateProperties	创建 keyVault 协定详细信息。
KeyVaultContractProperties	KeyVault 合同详细信息。
KeyVaultLastAccessStatusContractProperties	发出协定更新属性。

CertificateContract

证书详细信息。

名称	类型	说明
id	string	资源的完全限定的资源 ID。 例如 - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
name	string	资源的名称
properties.expirationDate	string	证书的到期日期。 日期符合以下格式： yyyy-MM-ddTHH:mm:ssZ 由 ISO 8601 标准指定。
properties.keyVault	KeyVaultContractProperties	证书的 KeyVault 位置详细信息。
properties.subject	string	证书的主题属性。
properties.thumbprint	string	证书的指纹。
type	string	资源类型。 例如“Microsoft.Compute/virtualMachines”或“Microsoft.Storage/storageAccounts”

CertificateCreateOrUpdateParameters

证书创建或更新详细信息。

名称	类型	说明
properties.data	string	使用 application/x-pkcs12 表示形式的 Base 64 编码证书。
properties.keyVault	KeyVaultContractCreateProperties	证书的 KeyVault 位置详细信息。
properties.password	string	证书的密码

ErrorFieldContract

错误字段协定。

名称	类型	说明
code	string	属性级错误代码。
message	string	属性级错误的可读表示形式。
target	string	属性名称。

ErrorResponse

错误响应。

名称	类型	说明
error.code	string	服务定义的错误代码。 此代码用作响应中指定的 HTTP 错误代码的子状态。
error.details	ErrorFieldContract[]	在发生验证错误时，请求中发送的无效字段列表。
error.message	string	错误的用户可读表示形式。

KeyVaultContractCreateProperties

创建 keyVault 协定详细信息。

名称	类型	说明
identityClientId	string	对于 SystemAssignedIdentity，或 UserAssignedIdentity 的客户端 ID 为 Null，这将用于访问密钥保管库机密。
secretIdentifier	string	用于提取机密的密钥保管库机密标识符。 提供版本控制机密将阻止自动刷新。 这要求API 管理服务配置 aka.ms/apimmsi

KeyVaultContractProperties

KeyVault 合同详细信息。

名称	类型	说明
identityClientId	string	对于 SystemAssignedIdentity，或 UserAssignedIdentity 的客户端 ID 为 Null，这将用于访问密钥保管库机密。
lastStatus	KeyVaultLastAccessStatusContractProperties	上次从密钥保管库同步和刷新机密的状态。
secretIdentifier	string	用于提取机密的密钥保管库机密标识符。 提供版本控制机密将阻止自动刷新。 这要求API 管理服务配置 aka.ms/apimmsi

KeyVaultLastAccessStatusContractProperties

发出协定更新属性。

名称	类型	说明
code	string	用于从密钥保管库同步和刷新机密的最后状态代码。
message	string	错误的详细信息，否则为空。
timeStampUtc	string	上次访问机密的时间。 日期符合以下格式： yyyy-MM-ddTHH:mm:ssZ 由 ISO 8601 标准指定。