Azure Key Vault Certificates for Rust
Guides Rust applications in creating, managing, and using X.509 certificates in Azure Key Vault.
The skill restricts use to the official crate, advises against hardcoded credentials, and distinguishes local from production identity, reducing dependency and credential risk. However, certificate creation, update, signing, and deletion can create external or sensitive effects without confirmation, least-privilege guidance, data-flow disclosure, deletion recovery, or rollback, so points are deducted.
The installation, authentication, LRO, pagination, and signing examples are broadly consistent and explain Poller behavior and some dependencies. However, versions are unpinned, installation omits the Key Vault Keys crate used by the signing example, and abnormal-input, authorization, polling, and network failure diagnostics are absent. Static calibration limits the score to 10 or below.
The audience, Rust use cases, trigger phrases, and main certificate operations are reasonably clear. Non-fit boundaries, certificate-format and key-type constraints, production boundaries, Chinese-language usage, and mainland-China network reachability are not addressed, limiting evidence for precise triggering and environment fit.
The document is well organized with installation, environment variables, authentication, workflows, best practices, RBAC, formats, and reference links; MIT licensing, author metadata, and official-source attribution are present. It lacks an SDK version policy, changelog, explicit maintenance/update path, FAQ, and systematic troubleshooting, with some dependency assumptions hidden in examples.
The snippets can directly guide retrieval, self-signed creation, updates, deletion, pagination, and signing, giving useful core coverage. CA-issued workflows, complete project configuration, certificate-content export, recovery behavior, and installation of the signing dependency are incomplete; static review cannot establish compilation or result correctness, so the score is capped at 7.
The skill supplies docs.rs, crates.io, and Azure SDK source references, while the repository materials show CI, evaluation workflows, and tests. The supplied evidence does not demonstrate coverage of this specific skill or provide target-skill acceptance examples or execution results; static calibration therefore caps the score at 5.
- The delete example lacks user confirmation, backup, recovery, or rollback guidance; safeguards should be added before production use.
- The signing example uses azure_security_keyvault_keys, but the installation command does not include that crate, so generated projects may not compile directly.
- There is no version pinning, API compatibility policy, or skill-specific test evidence; verify the current SDK and compile before adoption.
- Mainland-China network access, proxy requirements, and offline alternatives are not documented.
What does this skill do, and when should you use it?
This skill is for developers using the Azure Key Vault Certificates Rust SDK. It covers creating self-signed and CA-issued certificates, updating properties, deleting certificates, listing them with pagination, and awaiting long-running issuance operations. It also shows how to sign data with a certificate-associated key through the Key Vault Keys SDK. The guidance includes authentication, RBAC roles, certificate formats, and dependency installation, and requires the official azure_security_keyvault_certificates crate.
It guides developers through creating a CertificateClient, authenticating with DeveloperToolsCredential, retrieving certificates, starting self-signed certificate creation, awaiting the returned Poller, updating certificate tags, deleting certificates, and iterating through certificate properties with a Pager. It also demonstrates using KeyClient to sign a digest with the certificate's associated key and documents PKCS#12 and PEM content types.
- A Rust developer building TLS/SSL services that needs to create or manage X.509 certificates in Key Vault.
- A team generating self-signed certificates for local development or testing.
- An application that creates CA-issued certificates and must handle long-running issuance operations.
- A developer who needs to use a Key Vault certificate's associated key for code signing or data signing.
- A team using Entra ID authentication that needs certificate-specific Key Vault RBAC guidance.
What are this skill's strengths and limitations?
- Covers the main certificate lifecycle operations plus signing with an associated key.
- Provides copyable Rust examples for Poller, Pager, ResourceExt, and authentication.
- Explicitly directs users to the official crate and warns against unofficial crates and version 0.21.0.
- Includes RBAC roles, PKCS#12 and PEM formats, and credential-handling practices.
- Its scope is Azure Key Vault Certificates and does not replace the separate Key Vault Keys or Secrets skills.
- The source provides no dedicated test scenarios or test-coverage evidence for this Rust skill.
- Detailed CA policy configuration, certificate import, and rotation workflows are not covered.
- Azure resource provisioning, permission setup, and runtime error handling remain the developer's responsibility.
How do you install this skill?
Install Rust and Cargo, then run this in the target Rust project: cargo add azure_security_keyvault_certificates azure_identity tokio futures. If the code imports azure_core types directly, also run cargo add azure_core. To install the repository collection, run npx skills add microsoft/skills and select the skill in the wizard; collection skills are installed to the selected agent directory, such as .github/skills/.
How do you use this skill?
After installation, invoke the skill with prompts such as "keyvault certificates rust", "CertificateClient rust", "create certificate rust", "self-signed certificate rust", or "X.509 rust". Set AZURE_KEYVAULT_URL, create a CertificateClient in Rust, use DeveloperToolsCredential for local development, and use ManagedIdentityCredential in production.