title: Azure Key Vault Certificates does not have the Private Key when retrieved via IKeyVaultClient.GetCertificateAsync
body: <p>I have 2 approaches to do the same thing, but Azure has deprecated the one that works, and the other method doesn't work.</p>
  
  <p><strong>The approach that works, but is deprecated:</strong></p>
  
  <p>I store my PFX in Azure Key Vault <strong>Secrets</strong>. (when I create the secret I see a warning stating that this feature is deprecated)</p>
  
  <p>and use the following code to retrieve it to create my certificate:</p>
  
  <pre><code>        SecretBundle secret = await keyVaultClient.GetSecretAsync(keyVaultUrl, "MyCert-Secret");
          X509Certificate2Collection exportedCertCollection = new X509Certificate2Collection();
          exportedCertCollection.Import(Convert.FromBase64String(secret.Value));
          X509Certificate2 certFromSecret = exportedCertCollection.Cast&lt;X509Certificate2&gt;().Single(s =&gt; s.HasPrivateKey);
  </code></pre>
  
  <p>credits to <a href="https://stackoverflow.com/a/40158825/1184584">this answer</a></p>
  
  <p>I'm able to use this certificate to host and access my application successfully.</p>
  
  <p><strong>The approach that doesn't work, but I should be using:</strong></p>
  
  <p>I store my certificate in the Azure Key vault <strong>Certificates</strong></p>
  
  <p>and use the following code to retrieve it and create the X509Certificate2:</p>
  
  <pre><code>        CertificateBundle certificateBundle = await keyVaultClient.GetCertificateAsync(keyVaultUrl, "MyCert-Certificate");
          X509Certificate2 certFromCertificate = new X509Certificate2(certificateBundle.Cer);
  </code></pre>
  
  <p>The problem with this approach is that the certificate does not contain the private key. i.e. certFromCertificate.HasPrivateKey  is false. </p>
  
  <p><strong>My Questions</strong></p>
  
  <p>Why does certFromSecret have the PrivateKey, while certFromCertificate doesn't?</p>
  
  <p>How can I retrieve a certificate from the key vault, where I can create a X509Certificate2 object to host my application in Kestrel with UseHttps.</p>