0
# Certificate Management
1

2
Operations for uploading and managing certificates for Recovery Services vaults. Certificates enable secure communication and authentication for backup and recovery operations, providing the cryptographic foundation for protecting data in transit and at rest.
3

4
## Capabilities
5

6
### Upload Certificate
7

8
Uploads a certificate to a Recovery Services vault for secure authentication and communication.
9

10
```python { .api }
11
def create(
12
    resource_group_name: str, 
13
    vault_name: str, 
14
    certificate_name: str, 
15
    certificate_request: Union[CertificateRequest, IO[bytes]], 
16
    **kwargs
17
) -> VaultCertificateResponse:
18
    """
19
    Uploads a certificate for a Recovery Services vault resource.
20
    
21
    Parameters:
22
    - resource_group_name: str - The name of the resource group
23
    - vault_name: str - The name of the recovery services vault
24
    - certificate_name: str - Certificate friendly name
25
    - certificate_request: Union[CertificateRequest, IO[bytes]] - Input to upload certificate
26
    
27
    Returns:
28
    VaultCertificateResponse: Response containing certificate details
29
    """
30
```
31

32
**Usage Example:**
33

34
```python
35
from azure.mgmt.recoveryservices.models import CertificateRequest, RawCertificateData, AuthType
36

37
# Read certificate from file
38
with open("certificate.cer", "rb") as cert_file:
39
    cert_data = cert_file.read()
40

41
# Create certificate request
42
certificate_request = CertificateRequest(
43
    properties=RawCertificateData(
44
        certificate=cert_data,
45
        auth_type=AuthType.AAD
46
    )
47
)
48

49
# Upload certificate
50
response = client.vault_certificates.create(
51
    resource_group_name="my-rg",
52
    vault_name="my-vault", 
53
    certificate_name="backup-certificate",
54
    certificate_request=certificate_request
55
)
56

57
print(f"Certificate uploaded: {response.name}")
58
print(f"Certificate ID: {response.id}")
59
print(f"Thumbprint: {response.properties.thumbprint}")
60
```
61

62
## Certificate Types
63

64
### Certificate Request
65

66
```python { .api }
67
class CertificateRequest:
68
    """
69
    Details of the certificate to be uploaded to the vault.
70
    
71
    Parameters:
72
    - properties: Optional[RawCertificateData] - Raw certificate data
73
    """
74
```
75

76
### Raw Certificate Data
77

78
```python { .api }
79
class RawCertificateData(ResourceCertificateDetails):
80
    """
81
    Raw certificate data.
82
    
83
    Parameters:
84
    - certificate: Optional[bytes] - The base64 encoded certificate raw data string
85
    - auth_type: Union[str, AuthType] - Specifies the authentication type (AAD, ACS)
86
    """
87
```
88

89
### Certificate Response
90

91
```python { .api }
92
class VaultCertificateResponse:
93
    """
94
    Certificate corresponding to a vault that can be used by clients to register themselves with the vault.
95
    
96
    Parameters:
97
    - name: Optional[str] - Resource name
98
    - type: Optional[str] - Resource type  
99
    - id: Optional[str] - Resource Id
100
    - properties: Optional[ResourceCertificateDetails] - Certificate details
101
    """
102
```
103

104
### Certificate Details
105

106
```python { .api }
107
class ResourceCertificateDetails:
108
    """
109
    Certificate details representing the Vault credentials for AAD.
110
    
111
    Parameters:
112
    - certificate: Optional[bytes] - The base64 encoded certificate raw data string
113
    - friendly_name: Optional[str] - Certificate friendly name
114
    - issuer: Optional[str] - Certificate issuer
115
    - resource_id: Optional[int] - Resource id of the vault
116
    - subject: Optional[str] - Certificate Subject Name
117
    - thumbprint: Optional[str] - Certificate thumbprint
118
    - valid_from: Optional[datetime] - Certificate Validity start Date time
119
    - valid_to: Optional[datetime] - Certificate Validity End Date time
120
    """
121
```
122

123
### AAD Certificate Details
124

125
```python { .api }
126
class ResourceCertificateAndAadDetails(ResourceCertificateDetails):
127
    """
128
    Certificate details representing the Vault credentials for AAD.
129
    
130
    Parameters:
131
    - aad_authority: Optional[str] - AAD tenant authority
132
    - aad_tenant_id: Optional[str] - AAD tenant Id
133
    - service_principal_client_id: Optional[str] - AAD service principal clientId
134
    - service_principal_object_id: Optional[str] - AAD service principal ObjectId
135
    - azure_management_endpoint_audience: Optional[str] - Azure Management Endpoint Audience
136
    """
137
```
138

139
### ACS Certificate Details
140

141
```python { .api }
142
class ResourceCertificateAndAcsDetails(ResourceCertificateDetails):
143
    """
144
    Certificate details representing the Vault credentials for ACS.
145
    
146
    Parameters:
147
    - global_acs_namespace: Optional[str] - ACS namespace name - used for ServiceBus connection
148
    - global_acs_host_name: Optional[str] - Acs mgmt host name to connect to
149
    - global_acs_rp_realm: Optional[str] - Global ACS namespace RP realm
150
    """
151
```
152

153
## Authentication Types
154

155
```python { .api }
156
class AuthType(str, Enum):
157
    """
158
    Specifies the authentication type.
159
    """
160
    INVALID = "Invalid"
161
    ACS = "ACS" 
162
    AAD = "AAD"
163
    ACCESS_CONTROL_SERVICE = "AccessControlService"
164
    AZURE_ACTIVE_DIRECTORY = "AzureActiveDirectory"
165
```
166

167
## Usage Patterns
168

169
### Certificate Upload with Error Handling
170

171
```python
172
from azure.core.exceptions import HttpResponseError
173
from azure.mgmt.recoveryservices.models import CertificateRequest, RawCertificateData, AuthType
174

175
def upload_vault_certificate(client, resource_group: str, vault_name: str, cert_file_path: str, cert_name: str):
176
    """Upload a certificate to a Recovery Services vault with proper error handling."""
177
    
178
    try:
179
        # Read certificate file
180
        with open(cert_file_path, "rb") as cert_file:
181
            cert_data = cert_file.read()
182
        
183
        # Create certificate request
184
        certificate_request = CertificateRequest(
185
            properties=RawCertificateData(
186
                certificate=cert_data,
187
                auth_type=AuthType.AAD
188
            )
189
        )
190
        
191
        # Upload certificate
192
        response = client.vault_certificates.create(
193
            resource_group_name=resource_group,
194
            vault_name=vault_name,
195
            certificate_name=cert_name,
196
            certificate_request=certificate_request
197
        )
198
        
199
        print(f"Certificate '{cert_name}' uploaded successfully")
200
        print(f"Thumbprint: {response.properties.thumbprint}")
201
        print(f"Valid from: {response.properties.valid_from}")
202
        print(f"Valid to: {response.properties.valid_to}")
203
        
204
        return response
205
        
206
    except FileNotFoundError:
207
        print(f"Certificate file not found: {cert_file_path}")
208
        raise
209
    except HttpResponseError as e:
210
        print(f"Failed to upload certificate: {e.status_code} - {e.message}")
211
        raise
212
    except Exception as e:
213
        print(f"Unexpected error during certificate upload: {e}")
214
        raise
215
```
216

217
### Certificate Validation
218

219
```python
220
from datetime import datetime, timezone
221

222
def validate_certificate_response(cert_response: VaultCertificateResponse) -> bool:
223
    """Validate that a certificate response is valid and not expired."""
224
    
225
    if not cert_response or not cert_response.properties:
226
        print("Invalid certificate response")
227
        return False
228
    
229
    props = cert_response.properties
230
    
231
    # Check if certificate has required properties
232
    if not props.thumbprint:
233
        print("Certificate missing thumbprint")
234
        return False
235
    
236
    # Check certificate validity
237
    if props.valid_to:
238
        now = datetime.now(timezone.utc)
239
        if props.valid_to < now:
240
            print(f"Certificate expired on {props.valid_to}")
241
            return False
242
        
243
        # Warn if certificate expires soon (within 30 days)
244
        days_until_expiry = (props.valid_to - now).days
245
        if days_until_expiry < 30:
246
            print(f"Warning: Certificate expires in {days_until_expiry} days")
247
    
248
    print(f"Certificate validation passed:")
249
    print(f"  Subject: {props.subject}")
250
    print(f"  Issuer: {props.issuer}")
251
    print(f"  Valid from: {props.valid_from}")
252
    print(f"  Valid to: {props.valid_to}")
253
    
254
    return True
255
```