title: Azure Key Vault mark private key as exportable
body: <p>I'm looking for a way to install a PFX certificate into my azure scaleset and mark the private key as exportable. </p>
  
  <p>Currently the certificate is installed on the cluster via the ARM template:</p>
  
  <pre><code>{   
      "certificateUrl": "https://xxx.vault.azure.net/secrets/xxx/111111",
      "certificateStore": "My"
  }
  </code></pre>
  
  <p>But the private key, which I need for local decryption, is not exportable. 
  I'm using bouncy castle to read create a AsymmetricCipherKeyPair:
  <code>DotNetUtilities.GetRsaKeyPair(privateKey)</code> (Which now throws a exception: <code>Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException:
     at System.Security.Cryptography.CngKey.Export (System.Security.Cryptography.Cng, Version=4.3.1.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a)</code></p>
  
  <p>I read <a href="https://docs.microsoft.com/en-us/azure/key-vault/about-keys-secrets-and-certificates#exportable-or-non-exportable-key" rel="nofollow noreferrer">here</a> that it should be defined in the policy that the key is exportable. But it is not possible to change the policy once the key is uploaded into the keyvault, but it is also not possible to set it up when you import the certificate.</p>