Azure Keyvault Certificates Rust

MicrosoftOfficialCreated by Microsoft

Skill
Tool integration
Cloud and DevOps
MIT
No issues found

From the author

Azure Key Vault Certificates library for Rust. Create, manage, and use X.509 certificates including self-signed and CA-issued. Triggers: "keyvault certificates rust", "CertificateClient rust", "create certificate rust", "self-signed certificate rust", "X.509 rust".

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides guidance on using the azure_security_keyvault_certificates crate to interact with Azure Key Vault. It covers the lifecycle management of X.509 certificates, including creation, retrieval, updates, and deletion. The documentation emphasizes proper authentication patterns for Rust, handling long-running operations (LROs) via pollers, and integrating with the Key Vault Keys SDK for cryptographic operations.

What it does

Create and manage self-signed or CA-issued X.509 certificates
Perform long-running certificate issuance operations
Update certificate properties and metadata tags
List and paginate through certificates in a vault
Authenticate using DeveloperToolsCredential or ManagedIdentityCredential
Perform cryptographic signing operations using certificate keys

When to use it

When building Rust applications that require secure certificate management
When you need to automate the lifecycle of TLS/SSL or authentication certificates
When integrating Azure Key Vault into a Rust-based cloud service
When you need to sign data using keys stored within Azure Key Vault

Advantages

Uses the official, supported Azure SDK for Rust
Provides thread-safe client implementation for concurrent tasks
Simplifies complex LROs with async-await poller patterns
Includes best practices for dependency management and authentication

Usage examples

“How do I create a self-signed certificate in Azure Key Vault using Rust?”: The agent provides a code snippet using CertificatePolicy and CreateCertificateParameters, demonstrating how to await the poller returned by begin_create_certificate.
“Show me how to list all certificates in my Key Vault with Rust.”: The agent provides an example using list_certificate_properties and the futures crate to iterate through the certificate stream.
“How do I sign data using a certificate key in Key Vault?”: The agent explains that you must use the Key Vault Keys SDK and provides a code example using KeyClient to perform a sign operation with a specific algorithm.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/microsoft/azure-keyvault-certificates-rust/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip azure-keyvault-certificates-rust.zip -d .agents/skills

Documentation by Microsoft

Azure Key Vault Certificates library for Rust

Manage X.509 certificates for TLS/SSL, code signing, and authentication.

Use this skill when:

An app needs to create or manage X.509 certificates in Key Vault from Rust
You need self-signed or CA-issued certificates
You need long-running operations (LRO) for certificate issuance
You need to sign data using a certificate's key

IMPORTANT: Only use the official azure_security_keyvault_certificates crate published by the azure-sdk crates.io user. Do NOT use unofficial or community crates. Official crates use underscores in names and none have version 0.21.0.

Installation

cargo add azure_security_keyvault_certificates azure_identity tokio futures

If your code uses azure_core types directly, add azure_core to Cargo.toml. If you only use azure_security_keyvault_certificates re-exports, direct azure_core dependency is optional.

Environment Variables

AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/ # Required for all operations

Authentication

Rust Azure SDK code must not use DefaultAzureCredential. The Rust identity crate does not provide that type.

use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_certificates::CertificateClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.
    let credential = DeveloperToolsCredential::new(None)?;
    let client = CertificateClient::new(
        "https://<vault-name>.vault.azure.net/",
        credential.clone(),
        None,
    )?;

    let cert = client
        .get_certificate("cert-name", None)
        .await?
        .into_model()?;
    println!("Certificate: {:?}", cert.id);
    Ok(())
}

Prefer the crate README/examples when checking LRO and poller usage rather than inferring public behavior from generated internal types.

Core Workflow

Create Self-Signed Certificate (LRO)

Creating a certificate is a long-running operation. Poller<T> implements IntoFuture — just .await:

use azure_security_keyvault_certificates::{
    models::{
        CertificatePolicy, CreateCertificateParameters, IssuerParameters,
        X509CertificateProperties,
    },
    ResourceExt,
};

let policy = CertificatePolicy {
    x509_certificate_properties: Some(X509CertificateProperties {
        subject: Some("CN=example.com".into()),
        ..Default::default()
    }),
    issuer_parameters: Some(IssuerParameters {
        name: Some("Self".into()),
        ..Default::default()
    }),
    ..Default::default()
};
let body = CreateCertificateParameters {
    certificate_policy: Some(policy),
    ..Default::default()
};

// Poller implements IntoFuture — await directly for completion
let cert = client
    .begin_create_certificate("cert-name", body.try_into()?, None)?
    .await?
    .into_model()?;

println!(
    "Name: {:?}, Version: {:?}",
    cert.resource_id()?.name,
    cert.resource_id()?.version,
);

Update Certificate Properties

use azure_security_keyvault_certificates::models::UpdateCertificatePropertiesParameters;
use std::collections::HashMap;

#[allow(clippy::needless_update)]
let params = UpdateCertificatePropertiesParameters {
    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),
    ..Default::default()
};

client
    .update_certificate_properties("cert-name", params.try_into()?, None)
    .await?
    .into_model()?;

Delete Certificate

client.delete_certificate("cert-name", None).await?;

List Certificates (Pagination)

list_certificate_properties returns a Pager<T> — iterate items directly:

use azure_security_keyvault_certificates::ResourceExt;
use futures::TryStreamExt as _;

let mut pager = client.list_certificate_properties(None)?;
while let Some(cert) = pager.try_next().await? {
    println!("Found: {}", cert.resource_id()?.name);
}

Signing with a Certificate's Key

Certificates in Key Vault have an associated key. Use the Key Vault Keys SDK for crypto operations:

use azure_security_keyvault_keys::{
    models::{KeyClientSignOptions, SignParameters, SignatureAlgorithm},
    KeyClient,
};

let key_client = KeyClient::new(
    "https://<vault-name>.vault.azure.net/",
    credential.clone(),
    None,
)?;

// Sign with the certificate's EC key
let digest = vec![0u8; 32]; // SHA-256 digest
let body = SignParameters {
    algorithm: Some(SignatureAlgorithm::Es256),
    value: Some(digest),
};

let result = key_client
    .sign(
        "cert-name",
        body.try_into()?,
        Some(KeyClientSignOptions {
            key_version: Some("<certificate-version>".to_string()),
            ..Default::default()
        }),
    )
    .await?
    .into_model()?;
println!("Signature: {:?}", result.result);

Certificate Formats

Format	Content Type	Use Case
PKCS#12	`application/x-pkcs12`	Bundled cert + private key
PEM	`application/x-pem-file`	Base64-encoded, common in Linux/web

RBAC Roles

For Entra ID auth, assign one of these roles:

Role	Access
`Key Vault Certificate User`	Use certificates
`Key Vault Certificates Officer`	Full certificate management

Best Practices

Use cargo add to manage dependencies, never edit Cargo.toml directly. Add and remove Rust SDK dependencies with cargo commands instead of manual manifest edits.
Add azure_core only when importing azure_core types directly. If your code imports azure_core::http::Url, azure_core::http::RequestContent, or azure_core::error::ErrorKind, include azure_core; otherwise a direct dependency is optional.
Use DeveloperToolsCredential for local dev, ManagedIdentityCredential for production — Rust does not provide a single DefaultAzureCredential type
Never hardcode credentials — use environment variables or managed identity
Use ..Default::default() with #[allow(clippy::needless_update)] for model struct updates
Use ResourceExt to extract certificate name/version from IDs
LROs — begin_create_certificate returns a Poller; just .await for completion (clients should rarely poll for status)
Reuse clients — CertificateClient is thread-safe; create once, share across tasks
Run cargo clippy -- -D warnings when the prompt, eval, or CI expects lint-clean output

Reference Links

Resource	Link
API Reference	https://docs.rs/azure_security_keyvault_certificates/latest/azure_security_keyvault_certificates
crates.io	https://crates.io/crates/azure_security_keyvault_certificates
Source Code	https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_certificates

Files

ATTRIBUTION.mdAdded by AutoGineer1003 B
LICENSELicence file added by AutoGineer1.1 KiB
SKILL.md7.7 KiB

SKILL.md

Azure Key Vault Certificates library for Rust

Manage X.509 certificates for TLS/SSL, code signing, and authentication.

Use this skill when:

An app needs to create or manage X.509 certificates in Key Vault from Rust
You need self-signed or CA-issued certificates
You need long-running operations (LRO) for certificate issuance
You need to sign data using a certificate's key

IMPORTANT: Only use the official azure_security_keyvault_certificates crate published by the azure-sdk crates.io user. Do NOT use unofficial or community crates. Official crates use underscores in names and none have version 0.21.0.

Installation

cargo add azure_security_keyvault_certificates azure_identity tokio futures

If your code uses azure_core types directly, add azure_core to Cargo.toml. If you only use azure_security_keyvault_certificates re-exports, direct azure_core dependency is optional.

Environment Variables

AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/ # Required for all operations

Authentication

Rust Azure SDK code must not use DefaultAzureCredential. The Rust identity crate does not provide that type.

use azure_identity::DeveloperToolsCredential;
use azure_security_keyvault_certificates::CertificateClient;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Local dev: DeveloperToolsCredential. Production: use ManagedIdentityCredential.
    let credential = DeveloperToolsCredential::new(None)?;
    let client = CertificateClient::new(
        "https://<vault-name>.vault.azure.net/",
        credential.clone(),
        None,
    )?;

    let cert = client
        .get_certificate("cert-name", None)
        .await?
        .into_model()?;
    println!("Certificate: {:?}", cert.id);
    Ok(())
}

Prefer the crate README/examples when checking LRO and poller usage rather than inferring public behavior from generated internal types.

Core Workflow

Create Self-Signed Certificate (LRO)

Creating a certificate is a long-running operation. Poller<T> implements IntoFuture — just .await:

use azure_security_keyvault_certificates::{
    models::{
        CertificatePolicy, CreateCertificateParameters, IssuerParameters,
        X509CertificateProperties,
    },
    ResourceExt,
};

let policy = CertificatePolicy {
    x509_certificate_properties: Some(X509CertificateProperties {
        subject: Some("CN=example.com".into()),
        ..Default::default()
    }),
    issuer_parameters: Some(IssuerParameters {
        name: Some("Self".into()),
        ..Default::default()
    }),
    ..Default::default()
};
let body = CreateCertificateParameters {
    certificate_policy: Some(policy),
    ..Default::default()
};

// Poller implements IntoFuture — await directly for completion
let cert = client
    .begin_create_certificate("cert-name", body.try_into()?, None)?
    .await?
    .into_model()?;

println!(
    "Name: {:?}, Version: {:?}",
    cert.resource_id()?.name,
    cert.resource_id()?.version,
);

Update Certificate Properties

use azure_security_keyvault_certificates::models::UpdateCertificatePropertiesParameters;
use std::collections::HashMap;

#[allow(clippy::needless_update)]
let params = UpdateCertificatePropertiesParameters {
    tags: Some(HashMap::from_iter(vec![("env".into(), "prod".into())])),
    ..Default::default()
};

client
    .update_certificate_properties("cert-name", params.try_into()?, None)
    .await?
    .into_model()?;

Delete Certificate

client.delete_certificate("cert-name", None).await?;

List Certificates (Pagination)

list_certificate_properties returns a Pager<T> — iterate items directly:

use azure_security_keyvault_certificates::ResourceExt;
use futures::TryStreamExt as _;

let mut pager = client.list_certificate_properties(None)?;
while let Some(cert) = pager.try_next().await? {
    println!("Found: {}", cert.resource_id()?.name);
}

Signing with a Certificate's Key

Certificates in Key Vault have an associated key. Use the Key Vault Keys SDK for crypto operations:

use azure_security_keyvault_keys::{
    models::{KeyClientSignOptions, SignParameters, SignatureAlgorithm},
    KeyClient,
};

let key_client = KeyClient::new(
    "https://<vault-name>.vault.azure.net/",
    credential.clone(),
    None,
)?;

// Sign with the certificate's EC key
let digest = vec![0u8; 32]; // SHA-256 digest
let body = SignParameters {
    algorithm: Some(SignatureAlgorithm::Es256),
    value: Some(digest),
};

let result = key_client
    .sign(
        "cert-name",
        body.try_into()?,
        Some(KeyClientSignOptions {
            key_version: Some("<certificate-version>".to_string()),
            ..Default::default()
        }),
    )
    .await?
    .into_model()?;
println!("Signature: {:?}", result.result);

Certificate Formats

Format	Content Type	Use Case
PKCS#12	`application/x-pkcs12`	Bundled cert + private key
PEM	`application/x-pem-file`	Base64-encoded, common in Linux/web

RBAC Roles

For Entra ID auth, assign one of these roles:

Role	Access
`Key Vault Certificate User`	Use certificates
`Key Vault Certificates Officer`	Full certificate management

Best Practices

Use cargo add to manage dependencies, never edit Cargo.toml directly. Add and remove Rust SDK dependencies with cargo commands instead of manual manifest edits.
Add azure_core only when importing azure_core types directly. If your code imports azure_core::http::Url, azure_core::http::RequestContent, or azure_core::error::ErrorKind, include azure_core; otherwise a direct dependency is optional.
Use DeveloperToolsCredential for local dev, ManagedIdentityCredential for production — Rust does not provide a single DefaultAzureCredential type
Never hardcode credentials — use environment variables or managed identity
Use ..Default::default() with #[allow(clippy::needless_update)] for model struct updates
Use ResourceExt to extract certificate name/version from IDs
LROs — begin_create_certificate returns a Poller; just .await for completion (clients should rarely poll for status)
Reuse clients — CertificateClient is thread-safe; create once, share across tasks
Run cargo clippy -- -D warnings when the prompt, eval, or CI expects lint-clean output

Reference Links

Resource	Link
API Reference	https://docs.rs/azure_security_keyvault_certificates/latest/azure_security_keyvault_certificates
crates.io	https://crates.io/crates/azure_security_keyvault_certificates
Source Code	https://github.com/Azure/azure-sdk-for-rust/tree/main/sdk/keyvault/azure_security_keyvault_certificates

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/skills · .github/plugins/azure-sdk-rust/skills/azure-keyvault-certificates-rust · commit 0696600

Licence

MIT License (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download azure-keyvault-certificates-rust.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Microsoft

Azure Key Vault Certificates library for Rust

Installation

Environment Variables

Authentication

Core Workflow

Create Self-Signed Certificate (LRO)

Update Certificate Properties

Delete Certificate

List Certificates (Pagination)

Signing with a Certificate's Key

Certificate Formats

RBAC Roles

Best Practices

Reference Links

Files

SKILL.md

Azure Key Vault Certificates library for Rust

Installation

Environment Variables

Authentication

Core Workflow

Create Self-Signed Certificate (LRO)

Update Certificate Properties

Delete Certificate

List Certificates (Pagination)

Signing with a Certificate's Key

Certificate Formats

RBAC Roles

Best Practices

Reference Links

Requirements and compatibility

Security

Attribution and licence

Related skills

Modal

Cloud Infrastructure Network Engineer

Deployment Validation Cloud Architect

Airflow Dag Patterns

Cost Optimization

Hybrid Cloud Networking

Download ZIP