Does KeyVault__CertificateExportable enable PFX Secret creation in version 4.3.1?

[alexcordova1978]

Hi,

I’m currently using KeyVault-Acmebot v4.3.1 to issue certificates for my Azure Key Vault.
I’ve added the following Application Setting in my Function App configuration:

KeyVault__CertificateExportable = true

After restarting the Function App and requesting a new certificate issuance (not a renewal), the certificate was created successfully in Certificates, but no Secret object was generated in the Key Vault (only the Certificate and Key objects exist).

I expected this setting to make the certificate key exportable and to automatically create the associated Secret (PFX Base64) so that it could be downloaded via PowerShell.

Could you please confirm:

• Whether KeyVault__CertificateExportable (or any similar setting) is actually supported in v4.3.1, and
• If so, under what conditions the Secret is created (e.g., certificate must be newly created, Key Vault permissions required, etc.)?
• If this option was introduced or changed in a newer version, could you point me to the corresponding release or documentation?

Thanks a lot for your help and for maintaining this excellent project! 🙏

— Alex

[shibayan]

Certificate export should work without issues by default. You can download it with the private key using commands like az keyvault secret download. You must download it as a secret.

[alexcordova1978]

Thank you for your quick response!

Just to clarify our use case — we are trying to install the certificate on an Azure Virtual Machine using the Azure Key Vault VM Extension, which automatically retrieves certificates from the Key Vault under the Secrets section, if I'm not wrong according to the documentation about this extension.

Currently, the certificate generated by Acmebot appears only under Certificates, but it seems that the VM extension can only pull certificates if they also exist as Secrets (with the base64-encoded PFX content).

Could you please confirm if the certificate created by Acmebot can be used or accessed by the Key Vault VM Extension, or if there’s a specific configuration needed to make that possible?

Thank you again for your help and for maintaining this excellent project.

[alexcordova1978]

You are right, thank you. I did some test from my terminal to check the properties of the certificate and efective this have the key mark like exportable, so I tried to get the secret URL with this command:

az keyvault secret show --vault-name <vaultname> --name <certificatename> --query id -o tsv

And this work perfect returns me the URL that I need to use with the Azure KeyVault extension.

Really, I appreciate your excellent work on this project and the time that you take to answer me.

Thanks and regards.