You already have an agent pool with online agent in a deployment pool<\/p>\n
![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-22.png\")
<\/p>\n
And, finally, that you have a pipeline deployment that uses a static keystore. We will be replacing that static keystore file with one obtained from the Azure Key Vault.<\/p>\n
First, ensure the Azure DevOps service connection<\/strong> used by the pipeline has access to LJRVenafiTestKeyVault with at least:<\/p>\n From the Azure command line, e.g.<\/p>\n az role assignment create –assignee-object-id 107d2d9a-4d1b-4d8b-9cd6-0f95587eb9ae –assignee-principal-type ServicePrincipal –role “Key Vault Secrets User” –scope “\/subscriptions\/dede429d-a340-4e90-8f76-05aa5280a1f5\/resourceGroups\/ljr-keyvault-demo\/providers\/Microsoft.KeyVault\/vaults\/LJRVenafiTestKeyVault”<\/p>\n If you do not know which service connection is being used, update and run the pipeline. It will fail with a permission error, but the service connection\u2019s usage history will reflect the release pipeline\u2019s use:<\/p>\n Update your pipeline to retrieve the certificate from the Azure KeyVault. Add an Azure CLI task using an inline script<\/p>\n set -euo pipefail<\/p>\n PFX_FILE=”$AGENT_TEMPDIRECTORY\/VenafiDeployedCertificate.pfx”<\/p>\n az keyvault secret download \\<\/p>\n –vault-name LJRVenafiTestKeyVault \\<\/p>\n –name VenafiDeployedCertificate \\<\/p>\n –file “$PFX_FILE” \\<\/p>\n –encoding base64<\/p>\n echo “Downloaded PFX to $PFX_FILE”<\/p>\n echo “##vso[task.setvariable variable=PFX_PATH]$PFX_FILE”<\/p>\n If you need a JKS file, add an additional bash task with an inline script<\/p>\n set -euo pipefail<\/p>\n JKS_FILE=”$AGENT_TEMPDIRECTORY\/VenafiDeployedCertificate.jks”<\/p>\n # Verify keytool exists<\/p>\n command -v keytool >\/dev\/null 2>&1 || { echo “keytool not found on agent”; exit 1; }<\/p>\n keytool -importkeystore \\<\/p>\n -srckeystore “$(PFX_PATH)” \\<\/p>\n -srcstoretype PKCS12 \\<\/p>\n -srcstorepass “” \\<\/p>\n -destkeystore “$JKS_FILE” \\<\/p>\n -deststoretype JKS \\<\/p>\n -deststorepass “$(JksPassword)” \\<\/p>\n -destkeypass “$(JksPassword)” \\<\/p>\n -noprompt<\/p>\n echo “Created JKS at $JKS_FILE”<\/p>\n echo “##vso[task.setvariable variable=JKS_PATH]$JKS_FILE”<\/p>\n Add a pipeline variable for the JKS Password \u2013 make sure to click the lock icon to protect the password<\/p>\n And, finally, add a bash task task to copy the JKS or PFX file to the proper place on the server<\/p>\n set -euo pipefail<\/p>\n # Copy JKS to location on server used in app config<\/p>\n TARGET_DIR=”\/opt\/credential-injection\/certs”<\/p>\n TARGET_JKS=”$TARGET_DIR\/VenafiDeployedCertificate.jks”<\/p>\n cp “$(JKS_PATH)” “$TARGET_JKS”<\/p>\n chmod 600 “$TARGET_JKS”<\/p>\n echo “JKS copied to $TARGET_JKS”<\/p>\n # Or copy pfx to location on server used in app config<\/p>\n TARGET_PFX=”$TARGET_DIR\/VenafiDeployedCertificate.pfx”<\/p>\n cp “$(PFX_PATH)” “$TARGET_PFX”<\/p>\n chmod 600 “$TARGET_PFX”<\/p>\n Create a release to run the pipeline. Looking at the logs, you should see a confirmation that the pfx file was created<\/p>\n And, if you are creating a JKS file, a confirmation that it was created as well<\/p>\n You should also see the certificate file(s) on the server:<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" This document assumes: Azure CLI is installed (https:\/\/learn.microsoft.com\/en-us\/cli\/azure\/install-azure-cli-linux) You already have an agent pool with online agent in a deployment pool And, finally, that you have a pipeline deployment that uses a static keystore. We will be replacing that static keystore file with one obtained from the Azure Key Vault. First, ensure the Azure DevOps …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1510,30],"tags":[2194,2193,2184,2192],"class_list":["post-12158","post","type-post","status-publish","format-standard","hentry","category-ado","category-system-administration","tag-certificate-automation","tag-certificate-management","tag-venafi","tag-venafi-tpp"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12158"}],"version-history":[{"count":3,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12158\/revisions"}],"predecessor-version":[{"id":12307,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12158\/revisions\/12307"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-23.png\")
<\/p>\n![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-24.png\")
<\/p>\n![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-25.png\")
<\/p>\n![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-26.png\")
<\/p>\n![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-27.png\")
<\/p>\n![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-28.png\")
<\/p>\n![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-29.png\")
<\/p>\n![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-30.png\")
<\/p>\n![](\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2026\/04\/word-image-12158-31.png\")
<\/p>\n