--- title: "Imports a certificate into a specified key vault." method: POST path: "/certificates/{certificate-name}/import" tags: ["Certificates"] --- # Imports a certificate into a specified key vault. `POST /certificates/{certificate-name}/import` Imports an existing valid certificate, containing a private key, into Azure Key Vault. The certificate to be imported can be in either PFX or PEM format. If the certificate is in PEM format the PEM file must contain the key as well as x509 certificates. This operation requires the certificates/import permission. ## Path parameters - `certificate-name` string, required ## Query parameters - `api-version` string, required ## Request body - CertificateImportParameters — The certificate import parameters. - `value` string, required — Base64 encoded representation of the certificate object to import. This certificate needs to contain the private key. - `pwd` string — If the private key in base64EncodedCertificate is encrypted, the password used for encryption. - `policy` CertificatePolicy — Management policy for a certificate. - `id` string — The certificate id. - `key_props` KeyProperties — Properties of the key pair backing a certificate. - `exportable` boolean — Indicates if the private key can be exported. - `kty` 'EC' | 'EC-HSM' | 'RSA' | 'RSA-HSM' | 'oct' — The type of key pair to be used for the certificate. - `key_size` integer — The key size in bits. For example: 2048, 3072, or 4096 for RSA. - `reuse_key` boolean — Indicates if the same key pair will be used on certificate renewal. - `crv` 'P-256' | 'P-384' | 'P-521' | 'P-256K' — Elliptic curve name. For valid values, see JsonWebKeyCurveName. - `secret_props` SecretProperties — Properties of the key backing a certificate. - `contentType` string — The media type (MIME type). - `x509_props` X509CertificateProperties — Properties of the X509 component of a certificate. - `subject` string — The subject name. Should be a valid X509 distinguished Name. - `ekus` string[] — The enhanced key usage. - `sans` SubjectAlternativeNames — The subject alternate names of a X509 object. - `emails` string[] — Email addresses. - `dns_names` string[] — Domain names. - `upns` string[] — User principal names. - `key_usage` string[] — List of key usages. - `validity_months` integer — The duration that the certificate is valid in months. - `lifetime_actions` LifetimeAction[] — Actions that will be performed by Key Vault over the lifetime of a certificate. - `trigger` Trigger — A condition to be satisfied for an action to be executed. - `lifetime_percentage` integer — Percentage of lifetime at which to trigger. Value should be between 1 and 99. - `days_before_expiry` integer — Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). - `action` Action — The action that will be executed. - `action_type` 'EmailContacts' | 'AutoRenew' — The type of the action. - `issuer` IssuerParameters — Parameters for the issuer of the X509 component of a certificate. - `name` string — Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. - `cty` string — Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' - `cert_transparency` boolean — Indicates if the certificates generated under this policy should be published to certificate transparency logs. - `attributes` CertificateAttributes — The object attributes managed by the KeyVault service. - `enabled` boolean — Determines whether the object is enabled. - `nbf` integer — Not before date in UTC. - `exp` integer — Expiry date in UTC. - `created` integer — Creation time in UTC. - `updated` integer — Last updated time in UTC. - `attributes` CertificateAttributes — The object attributes managed by the KeyVault service. - `enabled` boolean — Determines whether the object is enabled. - `nbf` integer — Not before date in UTC. - `exp` integer — Expiry date in UTC. - `created` integer — Creation time in UTC. - `updated` integer — Last updated time in UTC. - `tags` object — Application specific metadata in the form of key-value pairs. ## Response `200` Imported certificate bundle to the vault. - CertificateBundle — A certificate bundle consists of a certificate (X509) plus its attributes. - `id` string — The certificate id. - `kid` string — The key id. - `sid` string — The secret id. - `x5t` string, base64url — Thumbprint of the certificate. - `policy` CertificatePolicy — Management policy for a certificate. - `id` string — The certificate id. - `key_props` KeyProperties — Properties of the key pair backing a certificate. - `exportable` boolean — Indicates if the private key can be exported. - `kty` 'EC' | 'EC-HSM' | 'RSA' | 'RSA-HSM' | 'oct' — The type of key pair to be used for the certificate. - `key_size` integer — The key size in bits. For example: 2048, 3072, or 4096 for RSA. - `reuse_key` boolean — Indicates if the same key pair will be used on certificate renewal. - `crv` 'P-256' | 'P-384' | 'P-521' | 'P-256K' — Elliptic curve name. For valid values, see JsonWebKeyCurveName. - `secret_props` SecretProperties — Properties of the key backing a certificate. - `contentType` string — The media type (MIME type). - `x509_props` X509CertificateProperties — Properties of the X509 component of a certificate. - `subject` string — The subject name. Should be a valid X509 distinguished Name. - `ekus` string[] — The enhanced key usage. - `sans` SubjectAlternativeNames — The subject alternate names of a X509 object. - `emails` string[] — Email addresses. - `dns_names` string[] — Domain names. - `upns` string[] — User principal names. - `key_usage` string[] — List of key usages. - `validity_months` integer — The duration that the certificate is valid in months. - `lifetime_actions` LifetimeAction[] — Actions that will be performed by Key Vault over the lifetime of a certificate. - `trigger` Trigger — A condition to be satisfied for an action to be executed. - `lifetime_percentage` integer — Percentage of lifetime at which to trigger. Value should be between 1 and 99. - `days_before_expiry` integer — Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27). - `action` Action — The action that will be executed. - `action_type` 'EmailContacts' | 'AutoRenew' — The type of the action. - `issuer` IssuerParameters — Parameters for the issuer of the X509 component of a certificate. - `name` string — Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'. - `cty` string — Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL' - `cert_transparency` boolean — Indicates if the certificates generated under this policy should be published to certificate transparency logs. - `attributes` CertificateAttributes — The object attributes managed by the KeyVault service. - `enabled` boolean — Determines whether the object is enabled. - `nbf` integer — Not before date in UTC. - `exp` integer — Expiry date in UTC. - `created` integer — Creation time in UTC. - `updated` integer — Last updated time in UTC. - `cer` string, byte — CER contents of x509 certificate. - `contentType` string — The content type of the secret. - `attributes` CertificateAttributes — The object attributes managed by the KeyVault service. - `enabled` boolean — Determines whether the object is enabled. - `nbf` integer — Not before date in UTC. - `exp` integer — Expiry date in UTC. - `created` integer — Creation time in UTC. - `updated` integer — Last updated time in UTC. - `tags` object — Application specific metadata in the form of key-value pairs ## Other responses - `default` — Key Vault error response describing why the operation failed. --- [API](https://skmtc.net/azure/apis/keyvaultclient.md) · [All operations](https://skmtc.net/azure/apis/keyvaultclient/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvaultclient/revisions/1f612999ec40/schema)