Understanding secrets, keys, and certificates

Secrets are data under 25 KB that our applications can store or retrieve in plain text. They are stored as a name-value pair of strings. Passwords, API keys, and connection strings can be stored securely as secrets in Key Vault.

Keys are cryptographic keys generated using an algorithm. Key Vault supports multiple sizes and algorithms of the RSA and Elliptic Curve (EC) key types. We can import RSA keys that we generated elsewhere into our vault, or we can generate RSA and EC keys in the vault itself. Depending on the pricing tier of Key Vault that we deployed (we will cover pricing tiers later in this chapter), the keys could either be software-protected or hardware-protected using Hardware Security Modules (HSMs).

Certificates refer to SSL/TLS X.509 certificates. These could either be self-signed certificates generated in the vault or certificates generated by external Certificate Authorities (CAs) that are integrated with Key Vault...